{
  "id": "vanderbilt-university-cyberattack",
  "url": "https://ohshit.app/incidents/vanderbilt-university-cyberattack/",
  "title": "Vanderbilt University restricts campus systems after cyberattack",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-09",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Vanderbilt",
    "higher education",
    "incident response"
  ],
  "ecosystems": [],
  "summary": "Vanderbilt asked its community to shut down university devices and disconnect from campus Wi-Fi on November 9. It later cleared university devices for use and restored several services in stages. The university is still investigating what data may have been accessed.",
  "splash": "Vanderbilt University-issued devices and university services. Campus IT is handling shared-staff issues with the separate medical center.",
  "wipe": "Use the university’s approved services list and report abnormal device behavior to the VUIT help desk.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Follow the university’s current service guidance",
      "hint": "Use the university FAQ to confirm approved applications before accessing them. Keep MFA enabled for Okta. Follow current VUIT instructions about university devices and use only approved alternatives for critical work."
    },
    {
      "title": "Report device symptoms through VUIT",
      "hint": "If a university-issued device shows unexpected pop-ups, unusual files or startup problems, file a VUIT help desk ticket from a trusted device through the university FAQ. Preserve relevant details and wait for instructions before bringing in equipment or attempting cleanup."
    },
    {
      "title": "Verify security messages and credential instructions",
      "hint": "Start from Vanderbilt News and official VUIT links. Follow any credential-reset instruction verified through VUIT, and report suspicious messages rather than using unexpected login links."
    }
  ],
  "sources": [
    {
      "name": "Vanderbilt University incident updates",
      "url": "https://news.vanderbilt.edu/2026/11/09/nov-9-active-cybersecurity-incident-updates/",
      "says": "Documents the initial shutdown request, staged restoration, ongoing investigation and official reporting channel.",
      "primary": true
    },
    {
      "name": "Vanderbilt University incident FAQ",
      "url": "https://news.vanderbilt.edu/cybersecurity-incident-faqs/",
      "says": "Lists available and restricted services, device reporting, credential guidance and medical-center scope.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Vanderbilt confirms an active cyberattack and temporary containment restrictions.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 9, 2026",
      "title": "University restricts campus devices and services",
      "body": "Vanderbilt asks the community to shut down university devices and leave campus Wi-Fi. Later that day Wi-Fi returns while most services remain restricted."
    },
    {
      "date": "Nov 10, 2026",
      "title": "University permits device use and restores core services",
      "body": "The university restores core services in stages, including Outlook and Okta with MFA, and asks users to report abnormal behavior."
    },
    {
      "date": "Nov 11, 2026",
      "title": "Recovery continues with some applications restricted",
      "body": "The university expects full restoration could take weeks and directs users to the current FAQ."
    }
  ],
  "body_markdown": "The university confirmed a cybersecurity incident affecting devices, systems and cloud services. It has not disclosed the entry method, a verified attacker identity, a count of impacted users or what data was taken. The FAQ says Vanderbilt University Medical Center is a separate entity and is monitoring the event, with known issues affecting employees shared by both organizations being addressed. The university believes device impacts are limited to its issued equipment. The FAQ lists Box, Oracle Cloud, Salesforce, PeopleSoft, SharePoint, Teams and OneDrive among restricted services. Check the live FAQ before use because the list can change during restoration."
}