BYOD is a ransomware and data-extortion group that claimed an attack on Vanderbilt University on 9 November 2026. Public detail on its malware and intrusion methods is thin, so this profile is mostly about observed behaviour: who it names, how it communicates and what victims have said. Every victim figure below is a leak-site claim, not a confirmed breach, unless we say a victim has confirmed it.
The Vanderbilt incident
Vanderbilt announced on Monday 9 November that it was dealing with “an active cybersecurity incident” affecting university devices, systems and cloud-based services, according to The Register’s report of 10 November. The Register says campus computers reportedly played an audio message, which the student paper The Vanderbilt Hustler sourced from posts on the campus social network Fizz. The recording said: “You have been compromised by BYOD.” We did not open the Hustler or Fizz posts, so the audio account rests on The Register.
BYOD claimed the attack the same day on its leak site, saying it held “over 1 million SSNs” plus student, employee and research records and “full takeover of your DC” (domain controller), as quoted by The Register. The group’s post, as excerpted on ransomware.live, also says “your databases are locked” and that it has “your entire estate and research da…” (the excerpt is truncated). That is an attacker statement; Vanderbilt has not confirmed encryption. Vanderbilt has not confirmed those claims. Its FAQ page, which we opened on 13 November, says the university is “continuing to assess the situation and determine what, if any, data may have been accessed”, and gives the same answer on whether research data was compromised.
What Vanderbilt itself has said, from its incident updates page:
- Campus Wi-Fi, Okta (with MFA), Outlook email, Brightspace, Zoom and course registration were restored first; other systems stayed restricted.
- The university said on 10 November, and repeated on 11 November, that it may take “multiple weeks” to fully restore normal operations. It also says payroll, payments, admissions, registration and public safety are prioritised.
- A later entry on the same page, which we could not date from the page text, says everyone must reset their password.
- Vanderbilt’s FAQ page answers “If I see suspicious activity, such as audio pop-ups playing, is my computer compromised?” with “Yes”: turn off the computer and use another uncompromised device to submit a ticket.
The page does not name BYOD, a ransomware family, an initial access method or any ransom demand. We found no statement of those in the sources we opened as of 2026-11-13.
Leak-site activity
Ransomware.live, a single aggregator, lists BYOD as active with 19 entries. Its first entry was discovered on 2026-10-05, its estimated earliest attack date is 2026-09-29, and its latest was discovered on 2026-11-10. The site reports an average delay of 2.2 days between attack and claim. Not every entry is an organisation: several are warnings, teasers or links to a social account. Ransomware.live’s own sector tally for the group is education 4, technology 4, manufacturing 2, hospitality 2 and healthcare 1, with the United States accounting for 7 entries.
Entries we saw, all attacker claims:
- University of New Mexico (26 October): the group claimed “36,000 machines” across two Active Directory forests including a hospital sector. A 27 October update said it was offering the decryption key for the remaining locked devices for free, with a restriction that reads “(ONLY for the hospit…” before the listing is cut off, so the full scope is not visible to us. The Register separately says BYOD previously claimed this attack.
- Michigan State University (2 November, ransomware.live only, not confirmed by the university in any source we opened): a claim of personal information on 1.03 million current and former students.
- IHG Hotels & Resorts (4 and 5 November): a claim that includes a weak LDAP binding password, followed by a “First and Final Warning” post with sample files.
- Texas Health and Human Services Commission (9 November), Toyota and Providence (both 10 November): The Register says the Texas agency has not publicly confirmed an incident. We have not found confirmation from Toyota or Providence in the sources opened, and the listing titles may not refer to the parent organisations.
Our assessment, based on a small and unconfirmed sample: several listed targets are large universities and well-known brands, and the group’s posts mention both stolen data and locked systems. UNM’s “decryption key” post suggests at least some devices were locked there, and the Vanderbilt post says databases are locked. No victim has confirmed encryption in the sources we opened. Treat the group as active but unproven on scale.
What is not known
- Lineage and attribution. We found no vendor report naming BYOD’s relationship to another family as of 2026-11-13 in the sources we opened. Do not infer a rebrand.
- Initial access and tooling. Not documented in any source we opened.
- Whether the claimed data was real. Only the leak-site posts and, for Vanderbilt, the university’s “assessing” statement are available.
Indicators
Ransomware.live lists two contact indicators for the group: an email address, byod[@]onionmail[.]org, and a Session messenger ID (not reproduced here). Its leak-site address is also listed on the page. No file hashes, domains or IP addresses were published in any source we opened.
What defenders should do
These are our recommendations, not BYOD-specific vendor guidance.
- Assume a domain-controller compromise claim is credible until disproven: reset privileged and service credentials and review changes to Group Policy and AD objects, as Vanderbilt’s forced password reset indicates.
- Review LDAP bind accounts for weak or default passwords; one IHG claim cites exactly that.
- Know how to disable cloud file sync (OneDrive, SharePoint, Box) quickly. Vanderbilt disabled OneDrive, SharePoint and Teams.
- Prepare staff for a device that plays audio or shows a ransom message: power off, report from a clean device, use an out-of-band channel, which is what Vanderbilt’s FAQ tells its staff to do.
References
Access date for all links: 13 November 2026.