The incident may affect university devices, systems and cloud-based services, according to Vanderbilt. The university's IT team is investigating and working to contain the situation.

In guidance issued to the campus community, Vanderbilt warned that suspicious activity could include unexpected pop-ups, changes to files or cloud storage, unfamiliar applications, and unexpected requests for passwords or authentication approvals.

Anyone who notices unusual activity is being told not to click on links, attachments or unfamiliar prompts, and not to attempt to troubleshoot the problem themselves. Instead, they should shut down the device immediately and contact the IT service desk from a separate device or by telephone.

The university's directive, labeled "IMMEDIATE ACTION REQUIRED," lists four steps: do not click on any links, pop-ups, attachments or unfamiliar prompts; do not attempt to investigate or resolve the issue; shut down the device immediately to help prevent further security risks; and contact the IT service desk right away using a separate device or phone.

The disruption comes as universities nationwide have faced a rising wave of cyberattacks targeting campus networks, research data and personal information. Higher-education institutions often hold sensitive student records and valuable research, making them attractive targets for both criminal ransomware operations and state-linked actors.

For the Vanderbilt community, the immediate priority is containment. Students and employees who rely on university systems for coursework, email and cloud-based collaboration may face interruptions while IT staff work to secure the network. The university has not said how many devices or services are affected, nor has it estimated how long the response effort might take.

Community members who spot anything unusual are being asked to report it promptly rather than attempt a fix on their own — a standard precaution meant to keep compromised machines from spreading the problem further across the campus network.