The lawsuit, filed in Nashville federal court by Madison Brinnon, accuses the university of leaving highly sensitive information unencrypted and failing to meet basic federal cybersecurity standards. It seeks financial and compensatory damages, court-mandated security audits, and lifetime credit and identity theft monitoring for all affected individuals, funded by Vanderbilt. The plaintiffs have demanded a trial by jury.

The cyberattack, claimed by a ransomware group known as "BYOD" on the dark web, has compromised more than one million Social Security numbers, along with full names, email addresses, phone numbers, and extensive student and employee records, according to the group's boasts. The university has not confirmed the exact scope of the breach but has acknowledged the attack and is working with federal law enforcement and external cybersecurity partners to secure its networks.

In its latest updates, Vanderbilt administration said it is prioritizing critical operations including payroll, payment services, admissions, course registration, and public safety. Students, faculty, and staff have been instructed to power back on university-issued devices, remain vigilant, and report any suspicious activity to the VUIT help desk. Officials warn that a full restoration of all campus systems and applications will likely take multiple weeks.

The lawsuit is the first legal action stemming from the breach, but more could follow as affected individuals learn the extent of the data compromise. The case highlights growing concerns over institutional data security and the potential long-term risks of identity theft for thousands of students and employees.

Vanderbilt has not publicly commented on the lawsuit. The university continues to focus on containment and recovery while cooperating with investigators.