[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZZNtubBz0oiCsP06VLenZ1kyOcxlRApezI1-fWLaL5k":3},{"article":4,"iocs":50,"watch_terms":54,"solutions":55,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"8adaaacb-312b-4bf2-a727-2fa8871dd9dc","Vanderbilt University reels following ransomware attack claimed by BYOD group","vanderbilt-university-reels-following-ransomware-attack-claimed-by-byod-group-3596f8","Some services began returning online Tuesday following a ransomware incident detected on Monday across Vanderbilt systems and applications. The post Vanderbilt University reels following ransomware attack claimed by BYOD group appeared first on CyberScoop.","Vanderbilt University discovered a ransomware attack on Monday affecting campus systems and compromising personal data of students and employees. The BYOD ransomware group claimed responsibility and posted to its leak blog, claiming to have obtained over one million Social Security numbers. The university took services offline to contain the incident, with select systems including WiFi, Okta, Outlook, and Zoom resuming operation by Tuesday, while others remained restricted.","Ransomware group BYOD claims attack on Vanderbilt University, compromising student and employee data.","https:\u002F\u002Fcyberscoop.com\u002Fvanderbilt-university-ransomware-attack-byod\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F11\u002FScreenshot-2026-11-10-at-12.41.07-PM.png","2026-11-10T17:46:29+00:00","2026-11-10T18:01:13.769831+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"BYOD","threat_actor",{"name":21,"type":22},"Okta","product",{"name":24,"type":22},"Outlook",{"name":26,"type":22},"Brightspace",{"name":28,"type":22},"Zoom","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":29,"icon":31,"name":32,"slug":33},null,"Ransomware","ransomware",[35,40,45],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[51],{"type":52,"value":18,"context":53},"malware","Ransomware group claiming responsibility for Vanderbilt University attack; emerged September 2024",[21,26,28],{"controls":56,"vendors":139},[57,85,114],{"slug":58,"name":59,"problem":60,"products":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":79,"vendor_name":21,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":86,"name":87,"problem":88,"products":89},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"slug":115,"name":116,"problem":117,"products":118},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":49,"product_name":136,"url":137,"description":138},"CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",[],{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":150},"vanderbilt-ransomware-attack-exposes-over-one-million-ssns","Vanderbilt Ransomware Attack Exposes Over One Million SSNs","The BYOD ransomware group successfully compromised Vanderbilt University's systems, allegedly exfiltrating over one million Social Security numbers belonging to students and employees — a severe data protection failure. The university was forced to take multiple critical services offline, including WiFi, Okta, Outlook, and Zoom, illustrating how a ransomware attack can cripple institutional operations. The scale of the breach suggests inadequate controls around sensitive data storage, access, and encryption, as well as gaps in detecting and containing the intrusion before significant damage occurred. Ransomware groups increasingly target universities because they hold large volumes of sensitive personal data while often operating with fragmented, decentralized IT environments.",[145,146,147,148,149],"CIS Control 3: Data Protection (v8)","NIST SP 800-53 IR-4: Incident Handling","NIST CSF 2.0 PR.DS-01: Data-at-rest is protected","NIS2 Article 21(2)(b)","GDPR Article 32",{"GDPR Article 32":151,"NIS2 Article 21(2)(b)":152,"CIS Control 3: Data Protection (v8)":153,"NIST SP 800-53 IR-4: Incident Handling":154,"NIST CSF 2.0 PR.DS-01: Data-at-rest is protected":155},"Article 32 requires appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including protection of personal data — the mass SSN exfiltration indicates these measures were insufficient.","NIS2 Article 21(2)(b) requires entities to have effective incident handling capabilities; the forced shutdown of core services like WiFi, Okta, and Zoom suggests the response lacked pre-established containment procedures.","CIS Control 3 requires organizations to inventory, classify, and protect sensitive data — proper controls here would have limited the exposure of over one million SSNs.","IR-4 mandates documented incident handling procedures including containment and eradication steps, which would have guided a faster, more structured response than the reactive service shutdowns observed.","This category requires encryption and protection of data at rest, which if applied to the SSN records would have reduced the value of the exfiltrated data to the attacker."]