Vanderbilt University restricts campus systems after cyberattack
Vanderbilt asked its community to shut down university devices and disconnect from campus Wi-Fi on November 9. It later cleared university devices for use and restored several services in stages. The university is still investigating what data may have been accessed.
- Disclosed
- Nov 9, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Vanderbilt University-issued devices and university services. Campus IT is handling shared-staff issues with the separate medical center.
- Vanderbilt · higher education · incident response
- In the wild
- Yes
- Vanderbilt confirms an active cyberattack and temporary containment restrictions.
What happened
The university confirmed a cybersecurity incident affecting devices, systems and cloud services. It has not disclosed the entry method, a verified attacker identity, a count of impacted users or what data was taken. The FAQ says Vanderbilt University Medical Center is a separate entity and is monitoring the event, with known issues affecting employees shared by both organizations being addressed. The university believes device impacts are limited to its issued equipment. The FAQ lists Box, Oracle Cloud, Salesforce, PeopleSoft, SharePoint, Teams and OneDrive among restricted services. Check the live FAQ before use because the list can change during restoration.
Crime-scene timeline
Nov 9, 2026
University restricts campus devices and services
Vanderbilt asks the community to shut down university devices and leave campus Wi-Fi. Later that day Wi-Fi returns while most services remain restricted.
Nov 10, 2026
University permits device use and restores core services
The university restores core services in stages, including Outlook and Okta with MFA, and asks users to report abnormal behavior.
Nov 11, 2026
Recovery continues with some applications restricted
The university expects full restoration could take weeks and directs users to the current FAQ.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Vanderbilt University incident updatesPrimaryDocuments the initial shutdown request, staged restoration, ongoing investigation and official reporting channel.
- Vanderbilt University incident FAQPrimaryLists available and restricted services, device reporting, credential guidance and medical-center scope.