A ransomware attack discovered Monday at Vanderbilt University in Nashville, Tennessee appears to have compromised vast amounts of student and employee personal data, prompting the university to take several digital services intermittently offline as it continues responding to the incident.

As of Tuesday morning, the university shared an update that select campus-wide systems and applications were safe to use again, including campus WiFi, Okta, Outlook, Brightspace, Zoom and YES, while others remain restricted, including CampusPrint. Students, faculty and staff were also allowed to resume use of Vanderbilt devices, following orders to shut them down Monday. 

“Vanderbilt Information Technology continues to work with government agencies and other partners to manage this situation, and we will continue to send updates today and throughout this week for as long as necessary,” the update said. 

A ransomware group known as BYOD has taken responsibility for the attack, according to a post on the group’s leak blog. The group, which emerged in September, has since taken credit for several attacks targeting academic and health care institutions including one last month on the University of New Mexico Health Sciences Center that caused system outages, disrupted patient care and impacted academics.

The group claims to have more than one million Social Security numbers from the attack on Vanderbilt.

In a video posted to YouTube, a computer from Vanderbilt University plays an audio message announcing that a system has been compromised by BYOD. 

In its original notice on social media, the university warned community members on Monday to remain vigilant, shut down university devices and disconnect from campus Wi-Fi as the IT team was “actively investigating and working to contain the situation.”

The university urged users to take immediate action if they notice unusual or suspicious activity on their accounts or devices, including unexpected pop-ups, warnings or security notifications; unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage platforms; unexpected file movement, deletion, renaming or modification; unfamiliar applications, messages or prompts; or unexpected requests to enter passwords, approve authentication requests or provide login credentials.

In an interview with The Hustler, Vanderbilt University’s student publication, Student Government President Simran Fitzpatrick and Vice President William Dean said they met with Vanderbilt Student Affairs to express student frustrations and concerns about the university’s handling of the cybersecurity attack, and lack of communication. 

“Students are concerned about the cyberattacks and extortion threats, particularly what information was stolen, how it may be used, and how it could affect them personally,” Fitzpatrick and Dean said. “We are frustrated by the university’s lack of clear communication, and our priority is ensuring that students receive timely updates and are not academically penalized for circumstances beyond their control.

However, in the update on Tuesday morning, the university acknowledged that its efforts to contain and respond to the incident had disrupted normal communications.

“The cyberattack is like a building that just exploded and we are trying to gather the pieces,” a Vanderbilt IT representative said, according to the Hustler. 

The post Vanderbilt University reels following ransomware attack claimed by BYOD group appeared first on CyberScoop.

China-aligned attackers broke into the networks of U.S. and Canadian universities to steal sensitive data and establish persistent access via webshells and backdoors, Proofpoint threat researchers said Tuesday. 

The espionage-motivated attacks targeted physics and engineering departments, focusing on administrators and professors with national security links or organizations researching astrophysics and particle physics.

Proofpoint identified less than 10 university victims and estimates a few dozen universities may be impacted, Greg Lesnewich, principal threat researcher at Proofpoint, told CyberScoop. The company first observed the campaign in May and believes the campaign is ongoing. 

“There is a high likelihood that many victims have not been made aware of this activity yet,” Lesnewich added.

Researchers traced the attacks to a pair of critical vulnerabilities in Roundcube, an open-source email client, that were exploited and chained together to steal credentials and gain long-term access.

The threat cluster, which Proofpoint tracks as UNK_MassTraction, exploited CVE-2024-42009 to execute JavaScript inside the victim’s browser, then exploited CVE-2025-49113 to gain a foothold in the mailserver. 

The initial exploit in the chain only requires a victim to open an email, and the attackers sent victims a series of generic lures to trigger the initial access.

Proofpoint attributes the campaign to a China-aligned cluster because the attackers used a known covert network used by multiple China-aligned threat groups, an infection chain leading to VShell and left Chinese language artifacts in the phishing emails. 

Researchers haven’t drawn any conclusions about why attackers targeted the universities and what they are seeking. 

“We do not have data to suggest what got stolen, as we only observe the initial inbound email attempt,” Lesnewich said. 

The engineering aspects do align with China’s strategic initiatives, he added. Google threat hunters recently spotted a Chinese state-sponsored espionage group that burrowed into systems for years, stealing data across academia, medicine, military, cybersecurity and foreign policy. 

“China-aligned adversaries have been targeting other types of edge devices such as routers and VPN concentrators for years with various exploits to create a foothold into a target network, not using email for delivery,” Lesnewich said. “This campaign flips that on its head, using email to deliver an exploit chain to compromise a mail server, instead of using email to deliver a credential harvesting URL or malware to target an end user, not a server.”

The post Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities appeared first on CyberScoop.