The group, known as BYOD, asserted responsibility for the breach on Tuesday, according to Ransomware.live, a site that tracks ransomware attacks. BYOD claims to have exfiltrated more than a million Social Security numbers, along with names, emails, phone numbers and records belonging to both employees and students.

When asked by email whether BYOD was behind the breach and whether the group's claims about stolen data were accurate, a Vanderbilt spokesperson did not answer directly. Instead, the university referred reporters to its incident update webpage, saying that information is all it can share at this time.

"The website will continue to be updated with additional information as needed," the spokesperson said in part.

BYOD is a relatively new ransomware operation that first surfaced in September, according to CyberXTron, a cyber risk protection organization. The group's alleged victims include Trump Mobile, the wireless service launched by Donald Trump Jr. and Eric Trump. CyberXTron describes BYOD's pattern as stealing data and then publishing it on a leak site to pressure victims into paying.

The incident began Monday, when Vanderbilt urged students, faculty and staff to shut down university devices and disconnect from campus Wi-Fi. The university warned that the breach could affect devices, systems and cloud-based services, and advised community members to watch for suspicious activity such as unexpected pop-ups, file changes, unfamiliar applications and unusual password requests.

By Monday evening, campus Wi-Fi had been restored, but access to most Vanderbilt systems and applications remained restricted. In a statement on Facebook, the university acknowledged the disruption.

"We know this has disrupted important work and caused frustration across the university," the statement read. "Vanderbilt Information Technology is working with government agencies and other partners to manage this situation."

By Tuesday morning, Vanderbilt said students, staff and faculty could again access personal accounts, including Google accounts. Campus Wi-Fi, Okta (with multi-factor authentication), Vanderbilt email through Outlook, Brightspace, Zoom and the YES enrollment system were also back online. Sophomore class registration was proceeding as scheduled. However, all other university systems and applications, including CampusPrint, remained restricted.

Classes were expected to proceed on a normal schedule Tuesday, and student services and Student Care Network offices were open. Faculty with grant submissions due this week were advised to contact the office of Vice Provost for Research and Innovation Susan Marguiles for support.

Vanderbilt Health, which is legally and financially separate from the university, said its IT systems had not been affected but that it was monitoring the situation closely. "The safety of our patients is our top priority and patient care is continuing at all our hospital and clinical locations," a spokesperson said.

The university has asked anyone who notices suspicious activity to contact the IT Service Desk immediately at 615-343-9999 from a separate device or phone. Vanderbilt noted that its efforts to contain and respond to the incident have also constrained standard communications.

The breach raises serious concerns about the security of personal data held by one of Nashville's largest employers and educational institutions. The university has not confirmed the scope of the data theft, and it remains unclear whether affected individuals will be notified.