For: Vanderbilt University students, faculty, staff and researchers, and their families. This article is based on the university's official news post and does not cover attack techniques. The incident is ongoing and this page will change.
Developing: this article will be updated as the organisation publishes more
- Who is affected
Vanderbilt University students, faculty, staff and researchers, and their families.
- Confirmed so farSee the table ↓
- The incident
- Available services
- Still restricted
2 more
- Use of university devices
- Classes and registration
Listed as possibly affected
- What may be affected
- Not yet confirmed
- Whether data was accessed, lost or compromised (the university is determining what data, if any, may have been accessed)
- Which systems were affected and how widely
- The type and cause of the attack
2 more
- Whether the claim by a group is true
- When each restricted system will be restored (the university anticipates multiple weeks to fully restore normal operations)
- What to do nowSee the steps ↓
- Use the available services and plan on the rest being unavailable
- University devices can be used. Log a VUIT help desk ticket for anything abnormal or suspicious you have not yet reported
- Check coursework, registration and grant deadlines with the right office
4 more
- Check cloud storage such as OneDrive and Box for unusual changes
- Do not open links, attachments or unfamiliar prompts
- As a precaution, change reused passwords (general advice)
- If you are a Vanderbilt Health patient, check appointment information on the hospital's official site
- Where to verify (source)All sources ↓
- Vanderbilt University, MyVU News, "Nov. 9: Active Cybersecurity Incident Updates" (published November 9, 2026 at 11:19 a.m.; updates through 6 p.m. November 10; checked November 11, 2026)
- Last checked
- As of November 11, 2026 (the university's latest update is 6 p.m. November 10; the next is expected by 10 a.m. November 11)
Follow-up plans and what we checked
The university's official post was published on November 9, 2026 at 11:19 a.m., and later updates were added at 10:45 a.m., 1 p.m. and 7:15 p.m. on November 9 and 9 a.m. and 6 p.m. on November 10. The 6 p.m. November 10 update says IT is focused on containment and on determining what data, if any, may have been accessed, and that the next update is anticipated by 10 a.m. on Wednesday, November 11. When checked on November 11, 2026, the 10 a.m. November 11 update had not yet been posted.
What to do today if you are a student or staff member
Use the available services and plan on the rest being unavailable
In its 6 p.m. November 10 update, the university says the following are available: campus Wi-Fi, Okta (keep using multi-factor authentication), Vanderbilt email (on university and personal devices), CampusPrint, Brightspace, Zoom, and YES (all course registration is proceeding as scheduled). All other systems and applications remain restricted. It says people may use personal accounts such as Google as needed. It anticipates multiple weeks to fully restore normal operations across all systems, with services restored in a deliberate and secure manner. It does not say when specific systems will return. Watch the university's news section and follow its guidance.
University devices can be used. Log a VUIT help desk ticket for anything abnormal or suspicious you have not yet reported
In its November 10 updates, the university says students, faculty and staff can use university devices again. This changes the first notice of November 9, which asked people to shut them down. In the 6 p.m. update it asks that, when powering on a device, anything abnormal or suspicious that you have not already reported be logged immediately as a VUIT help desk ticket (the 9 a.m. update gave the IT Service Desk number, 615-343-9999). Examples to watch for, from the first notice of November 9: unexpected pop-ups or security notices, unusual file or permission changes, files being moved, deleted, renamed or modified, unfamiliar apps or messages, and unexpected requests for passwords or authentication approval. The first notice of November 9 also asked people not to investigate or fix anything themselves.
Check coursework, registration and grant deadlines with the right office
In its November 9 update the university says classes are on a normal schedule, and in its 6 p.m. November 10 update that all course registration is proceeding as scheduled. Students should ask instructors about coursework deadlines. Faculty are asked to teach as scheduled, and anyone with grant submissions due this week is asked to contact the Vice Provost for Research and Innovation's office. Staff are asked to report to work as scheduled.
Check cloud storage such as OneDrive and Box for unusual changes
The university asks people to watch for unusual changes in cloud storage platforms such as OneDrive and Box. If you notice missing or renamed files, do not try to fix them yourself; report to the IT Service Desk as above.
Do not open links, attachments or unfamiliar prompts
In its first notice of November 9, the university asks people not to open links, pop-ups, attachments or unfamiliar prompts. The university's 6 p.m. November 10 update asks people to rely on official Vanderbilt communications, which are also posted on the Vanderbilt News website and social media, for confirmed information. During an incident, fake messages posing as university IT are common. Do not use contact details in a message; check through official university pages such as news.vanderbilt.edu (how to spot these: What is phishing?).
As a precaution, change reused passwords (general advice)
It is not known whether data was taken. The university's November 10 update does not ask people to change passwords (it says to keep using multi-factor authentication with Okta). This step is general advice, not something the university has asked for. If you use your university password on other sites, change it from a personal device, not a university device. Turn on multi-factor authentication where you can (Multi-factor authentication guide).
If you are a Vanderbilt Health patient, check appointment information on the hospital's official site
The university's post does not mention patients or clinical care. Press reports quote Vanderbilt Health as saying it is a separate organization from the university, that its own systems have not been affected so far, and that care is continuing at all hospital and clinical locations. This is a press report of its statement, and this site has not checked a primary document. Confirm appointments through the hospital's official site or the number on your appointment card.
What happened (from the university's official news post)
This section is based on MyVU News, "Nov. 9: Active Cybersecurity Incident Updates" (published November 9, 2026 at 11:19 a.m.; the same page gained updates through 6 p.m. November 10). Times are as shown on the university's page, which gives no time zone.
Ongoing incident
Containment and data review continue
↓→
Partly available
Wi-Fi, Okta, email, CampusPrint, Brightspace, Zoom, YES
↓→
Others restricted
Weeks to full recovery
This is what the university's post says. It does not say whether data was affected.
November 9, 10:45 a.m.
The university said it is responding to an active cybersecurity incident that may affect university devices, systems and cloud-based services. Its IT team is investigating and working to contain it. It asked students, faculty and staff to shut down university devices, disconnect from campus Wi-Fi and stay alert for suspicious activity.November 9, 1 p.m.
It said classes are on a normal schedule. If an instructor has not been in touch, go to class as planned.November 9, 7:15 p.m.
It said campus Wi-Fi is available again. Most other systems and applications remain restricted. Classes, student services and the Student Care Network offices are on normal schedules. It promised the next update by 9 a.m. Tuesday (November 10).November 10, 9 a.m.
Describing an "ongoing cybersecurity hacking incident", it said Wi-Fi, Okta, Vanderbilt email, Brightspace, Zoom and YES are available. All other systems and applications, including CampusPrint, remained restricted at that point (CampusPrint became available at 6 p.m.). Students, faculty and staff can use university devices again, and should report anything abnormal to the IT Service Desk (615-343-9999). It said IT is working with government agencies and other partners and will update "today and throughout this week".November 10, 6 p.m.
It said Wi-Fi, Okta, Vanderbilt email, CampusPrint, Brightspace, Zoom and YES (all course registration on schedule) are available. All other systems and applications remain restricted. It anticipates it may take multiple weeks to fully restore normal operations across all systems, restoring them in a deliberate and secure manner. It is focused on containment and on determining what data, if any, may have been accessed. University devices can be used; log a VUIT help desk ticket for anything abnormal you have not already reported. Next update anticipated by 10 a.m. November 11.When checked on November 11, 2026
The 10 a.m. November 11 update had not yet appeared in the university's news section.
- Organization
- Vanderbilt University (Tennessee, US)
- Situation
- Responding to an active cybersecurity incident. May affect university devices, systems and cloud-based services. The 9 a.m. November 10 update calls it an "ongoing cybersecurity hacking incident" (the word ransomware does not appear)
- Response
- IT is focused on containment and on determining what data, if any, may have been accessed, working with government agencies and other partners. Next update anticipated by 10 a.m. November 11
- Available (6 p.m. November 10)
- Campus Wi-Fi, Okta (keep using multi-factor authentication), Vanderbilt email (university and personal devices), CampusPrint, Brightspace, Zoom, YES (all course registration proceeding as scheduled)
- Still restricted
- All other Vanderbilt systems and applications. The university anticipates multiple weeks to fully restore normal operations across all systems. Personal accounts such as Google may be used as needed
- Request to the community
- University devices can be used (November 10). Log a VUIT help desk ticket immediately for anything abnormal or suspicious you have not already reported (the 9 a.m. update gave the IT Service Desk number, 615-343-9999). The first notice of November 9 asked people to shut devices down and disconnect from campus Wi-Fi
- Classes
- Normal schedule. Ask instructors about coursework deadlines. Faculty with grant submissions due this week should contact the Vice Provost for Research and Innovation's office
- Signs to watch for
- Unexpected pop-ups or security notices, unusual file or permission changes, files moved, deleted, renamed or modified, unfamiliar apps or messages, unexpected requests for passwords or authentication approval
- Cloud services named
- OneDrive, Box
- Data
- The post does not say whether data was accessed, lost or compromised. It says it is determining what data, if any, may have been accessed
- Media contact
- 615-322-6397, MyVU@vanderbilt.edu (for media). Number listed in the university page footer: 615-322-7311
What is known and not known
| Item | What was announced | Status |
|---|---|---|
| The incident | Responding to an active cybersecurity incident (a hacking incident) | Confirmed (university) |
| What may be affected | University devices, systems and cloud-based services | Possible (university) |
| Available services | Wi-Fi, Okta, Vanderbilt email, CampusPrint, Brightspace, Zoom, YES (6 p.m. November 10) | Confirmed (university) |
| Still restricted | All other systems and applications. Multiple weeks anticipated to fully restore normal operations across all systems | Confirmed (university) / weeks anticipated (university) |
| Use of university devices | Students, faculty and staff can use them. Log a VUIT help desk ticket for anything abnormal you have not already reported | Confirmed (university) |
| Classes and registration | Classes on a normal schedule. All course registration proceeding as scheduled | Confirmed (university) |
| Data accessed, lost or compromised | Not stated. The university is determining what data, if any, may have been accessed | Not stated (under review) |
| Whether personal data is involved, and which | Not stated | Not stated |
| Type and cause of the attack | Called a "hacking incident" (9 a.m. November 10). Not described as ransomware. Cause not stated | Not stated |
| A group claiming responsibility | The university does not mention it. Press reports say a group has claimed it | Press report only (university has not confirmed) |
| Hospitals and clinical care | Not in the university's post. Press quotes a Vanderbilt Health statement saying it is not affected | Press report only |
How to read this: a group's claim is not confirmation
Press reports say a group has claimed responsibility, but the university has not confirmed it. Whatever the group says it took cannot be verified. This site does not present the claim as fact. Until the university announces whether personal data was affected, no one can say that data was or was not exposed.
What often happens at educational institutions
In general, organizations like universities can see effects like the following. This does not mean it has happened here.
- Phishing posing as university IT that targets student and staff accounts
- Convincing messages that use names, student records, financial aid or payroll details
- Effects on research data and course materials
- Disruption to classes and administration while systems are restored over days or weeks
In this kind of incident, details such as whether personal data was involved and how many people were affected sometimes come out after the first notice. That will not necessarily happen here.
Sources (public records)
The facts in this article are based on the public information below.
- Vanderbilt University, MyVU News, "Nov. 9: Active Cybersecurity Incident Updates" (published November 9, 2026 at 11:19 a.m.; updates through 6 p.m. November 10; checked November 11, 2026) — news.vanderbilt.edu
- WSMV, "Vanderbilt urges university community to shut down devices amid cybersecurity incident. Here's what we know" (press report; used only for the Vanderbilt Health statement) — wsmv.com
- The Record, report of 9 November 2026 (press report; used only for the claim by a group, which the university has not confirmed) — therecord.media
Update history
2026-11-11: Reflected the university's 6 p.m. November 10 update: CampusPrint is now available, other systems remain restricted, full restoration of normal operations across all systems may take multiple weeks, the university is determining what data, if any, may have been accessed, all course registration is on schedule, and abnormal activity should be logged as a VUIT help desk ticket. The "as of" wording was updated; the next update is expected by 10 a.m. November 11 and had not been posted when checked. Earlier the same day: reflected the university's updates of 1 p.m. and 7:15 p.m. on November 9 and 9 a.m. on November 10. Wi-Fi, Okta, Vanderbilt email, Brightspace, Zoom and YES are restored; most other systems remain restricted; university devices can be used again; the IT Service Desk number (615-343-9999) was added; classes are on schedule; the university calls it a "hacking incident" without the word ransomware and still says nothing about data. The steps and status were revised accordingly. No later university update could be found.
2026-11-10: First version, based on the university's official news post of November 9, 2026. No later university update could be found. The Vanderbilt Health status comes from press reports and no primary document was checked. The article will be updated when the university publishes more.
Read next
- A Japanese university ransomware case: Saga University ransomware
- A university case that separates official statements from reports: Osaka Metropolitan University ransomware
- A university data breach: University of Copenhagen data breach
- What ransomware is: What is ransomware?
- Preparing for fake messages: What is phishing?