Classes proceeded on a normal schedule, but students described improvised workarounds. Sophomore Parker Landis said he learned of the problem when he arrived at his 10:10 a.m. class to give a presentation. His professor told the class something was wrong, and a classmate pulled up a report from the student newspaper. The class completed the presentation using a teaching aide's phone hotspot, though the connection was spotty.

Landis said the university's alert reached him around lunchtime. Later, he could not open a Word document needed for an assignment. His Introduction to Law professor extended a deadline, his legal history professor postponed a discussion assignment, and another class relied on printed materials.

"It made things just a little more difficult just because we're so used to having all the technology," Landis said.

José Ruiz-Zepeda, a senior and opinion editor who wrote the student newspaper's initial report, said he first learned of the incident through a group chat. He said faculty received notice around 9:30 a.m., nearly two hours before students were notified around 11:26 a.m. Students were told to stay off Brightspace, the platform used for coursework, he said.

Ruiz-Zepeda said he received reports that audio warnings played and unfamiliar pop-ups appeared on university computers while professors were trying to teach. Some professors shut off their screens, he said. A separate video shared by the student newspaper circulated on Fizz, an anonymous student platform, and its source remained unverified.

A photo reviewed by local media shows a computer screen with a message bearing the name BYOD and claiming access to university data. The ransomware group calling itself BYOD claimed responsibility online and said it obtained student and employee records, including Social Security numbers. The group also claimed to have locked university databases and taken control of part of its network. Vanderbilt's public updates did not identify who was behind the incident or confirm whether records were taken.

The group has also claimed responsibility for recent cyberattacks at Michigan State University and the University of New Mexico Health and Sciences Center. At Michigan State, a cybersecurity incident prompted university-wide password resets, though officials said their investigation had not found evidence that other data was stolen. The New Mexico incident caused more significant disruptions, affecting hospital operations and forcing ambulances to be diverted.

Scott Augenbaum, a retired FBI supervisory special agent who investigated cybercrime, said universities hold sensitive research, student records, and financial information that can make them targets. He said an online claim alone cannot establish who was behind an incident or whether anyone took files. Investigators need to determine what was accessed and whether any information was copied.

Augenbaum said before Vanderbilt can safely restore access, it needs to make sure anyone who gained unauthorized access is out and figure out how they got in.

"And besides kicking them out, you got to figure out how it happened, so they just don't get back in," Augenbaum said.

He also warned that a message appearing to come from Vanderbilt could be used to trick someone into handing over a password. He advised people to verify unexpected requests independently and use two-factor authentication on personal and work accounts.

Vanderbilt urged students and employees to watch for unexpected pop-ups, unfamiliar apps or messages, requests for passwords or sign-in approvals, and files that suddenly go missing or change names. It also flagged unusual changes to folders or permissions in cloud services such as OneDrive and Box. The university told anyone who notices suspicious activity to avoid clicking links, attachments, or unfamiliar prompts, leave troubleshooting to IT, shut down the device, and contact the IT service desk from a separate device or by phone.

In a 7 p.m. update, Vanderbilt said campus Wi-Fi was available but most systems and applications remained restricted. The university said it was working with government agencies and other partners to manage the situation. It announced that Tuesday, Nov. 10, would operate on a normal schedule, with classes proceeding and student services operating normally. Faculty with grant submissions due this week were told to contact the vice provost for research and innovation for support. Staff were asked to report to work as scheduled. The next update was promised by 9 a.m. Tuesday.

Vanderbilt Health, which operates separately from the university, said its own IT systems had so far been unaffected, and patient care was continuing at its hospitals and clinics. It told employees to stay off university IT systems until further notice.

Landis said Vanderbilt had not told him whether student information was affected. He wondered how classes would continue if students could not access the tools they use to turn in assignments.

"I'm really hoping student information isn't affected," Landis said.