[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNDW2hAy58ttbEGqz3Brb1ehVAn4rHwtV7svqIMO68_0":3},{"article":4,"iocs":41,"watch_terms":45,"solutions":46,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"23e0fd98-7417-4c82-9bdb-bb1a48ebcab1","Ransomware threat blares from Vanderbilt University computers during cyberattack","ransomware-threat-blares-from-vanderbilt-university-computers-during-cyberattack-e7487d","BYOD claims extensive data theft as campus Wi-Fi returns, most systems remain restricted, and classes carry on","Vanderbilt University experienced a cyberattack claimed by the ransomware group BYOD, leading to restricted access to most university systems and potential data theft. Campus computers reportedly played an audio threat from the attackers, who claimed to have stolen extensive data including over a million SSNs and student\u002Femployee records. While campus Wi-Fi has been restored, access to many systems remains limited, though classes are proceeding as scheduled.","Ransomware group BYOD claims cyberattack on Vanderbilt University, causing data theft and system restrictions.","https:\u002F\u002Fwww.theregister.com\u002Fcyber-crime\u002F2026\u002F11\u002F10\u002Fransomware-threat-blares-from-vanderbilt-university-computers-during-cyberattack\u002F5308687","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5303385&width=800","2026-11-10T13:00:00+00:00","2026-11-10T13:00:26.206102+00:00",8,[17,20],{"name":18,"type":19},"BYOD","threat_actor",{"name":21,"type":22},"Vanderbilt University","product","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":23,"icon":25,"name":26,"slug":27},null,"Ransomware","ransomware",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":43,"value":18,"context":44},"malware","Ransomware group claiming responsibility for the attack",[21],{"controls":47,"vendors":132},[48,77,106],{"slug":49,"name":50,"problem":51,"products":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":78,"name":79,"problem":80,"products":81},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"slug":107,"name":108,"problem":109,"products":110},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":128,"product_name":129,"url":130,"description":131},"incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":143},"ransomware-attack-hits-vanderbilt-university-exposing-millions-of-records","Ransomware Attack Hits Vanderbilt University, Exposing Millions of Records","Vanderbilt University suffered a ransomware attack by the group BYOD, which gained sufficient access to encrypt or restrict most university systems and exfiltrate a claimed one million-plus Social Security Numbers along with student and employee records. The attackers even leveraged campus computers to broadcast audio threats, indicating deep penetration of internal systems before detection. This incident highlights the severe consequences of inadequate data protection controls, insufficient network segmentation, and delayed threat detection in higher education environments. Universities hold vast quantities of sensitive personal data, making them high-value targets that require enterprise-grade security postures.",[138,139,140,141,142],"NIST CSF 2.0 RS.MA-01: Incident Response Management","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SC-7: Boundary Protection","GDPR Article 32","NIS2 Article 21(2)(b)",{"GDPR Article 32":144,"NIS2 Article 21(2)(b)":145,"NIST SP 800-53 SC-7: Boundary Protection":146,"NIST SP 800-53 SI-3: Malicious Code Protection":147,"NIST CSF 2.0 RS.MA-01: Incident Response Management":148},"This article requires appropriate technical measures to protect personal data; the exfiltration of over a million SSNs and personal records indicates these measures were insufficient to protect the sensitive data held by the university.","This point requires entities to have effective incident handling procedures; the attackers' ability to escalate to audio broadcasts on campus computers before containment suggests incident detection and handling processes failed to respond quickly enough.","This control mandates network boundary monitoring and segmentation controls that, if implemented, could have limited the ransomware's lateral movement and prevented it from reaching systems holding over a million SSNs.","This control requires deploying and maintaining malware protection across all endpoints, which would have been critical to detecting or blocking the ransomware payload before it could restrict systems and play audio threats.","This category requires organizations to execute and maintain an incident response plan; the university's delayed containment and the attackers' ability to broadcast threats across campus systems suggests the IR plan was inadequate or not effectively executed."]