Vanderbilt Says Hack Recovery May Take Weeks

Vanderbilt University said on Wednesday that full recovery from a hack that hit its campus systems on Nov. 9 may take weeks. An update posted on the afternoon of Nov. 11 said the school is working with the federal government, law enforcement and other partners to resolve the incident. The university said its work centers on containment and on determining what data, if any, was accessed.

The incident began on Monday, Nov. 9. Vanderbilt announced an active cybersecurity incident that morning and urged students, faculty and staff to shut down university devices and disconnect from university WiFi. The Vanderbilt Hustler, the student newspaper, reported that the breach was discovered at 9:50 a.m. CST and that the university IT department, known as VUIT, confirmed a breach. WiFi access was restored by the evening of Nov. 9, and the university ran a normal schedule of classes on Tuesday, Nov. 10.

What is back, and what is not

By the evening of Nov. 10, Vanderbilt said campus WiFi, Okta, Outlook email, CampusPrint, Brightspace, Zoom and the YES enrollment system were safe and available, and it cleared students, faculty and staff to resume using university devices. Other services stayed restricted. The university FAQ listed Box, Oracle Cloud, Salesforce, PeopleSoft, SharePoint, Teams and OneDrive among the systems still limited while recovery work continues.

In its Nov. 10 evening update, the university said it was putting critical operations first, including payroll, payment services, admissions, course registration and public safety. It warned in the same update that full restoration across all systems could take multiple weeks, with services returning in stages as each one is checked and secured.

The claim the university has not confirmed

Who carried out the attack is still not confirmed. The Tennessean reported that BleepingComputer, a technology news site, said a group calling itself BYOD claimed responsibility and said it had taken more than a million Social Security numbers, along with names, contact information and other records. Vanderbilt has not confirmed that claim. The university has not said that Social Security numbers, health records or banking information were compromised, and it has not attributed the incident to any group. It said it does not believe personal devices were affected.

That gap between a public claim and an official confirmation is where the campus now sits. The university published an FAQ page on Nov. 10 and told its community to rely on official messages for confirmed information. Students and professors told The Tennessean that questions remain about what was taken and how long the disruption will last. The FBI field office in Nashville confirmed to the Hustler that the agency is involved in the investigation.

Why it matters

A research university runs on the systems this attack touched. Payroll, admissions, course registration and payments all sit inside the restricted set, and a recovery measured in weeks reaches students trying to register for classes and staff waiting on normal business tools. The university has put those operations first in line for restoration, which tells readers where the real pressure is.

For anyone who has studied, worked or received care linked to the university, the open question is personal data. The honest position today is narrow: an outside group claims it took records, and the university says it is still determining whether any data was accessed. Neither side of that question has been settled in public.

What happens next

Vanderbilt has promised regular updates on its news site for as long as the incident lasts. The facts that will move this story are the entry point of the attack, the date the intrusion began, and a confirmed answer on data exposure. Until the university or investigators publish those, the claim of stolen Social Security numbers stays a claim, stated here as one.