# Vanderbilt University Cybersecurity Investigation Canonical: https://hallattorneys.com/investigations/vanderbilt Published: November 9, 2026 Last reviewed: November 9, 2026 Student health and health services · Researchers and research participants Hall Attorneys is investigating Vanderbilt’s cybersecurity incident and seeking Student Health Center users, health-service users, researchers, and research participants. Hall Attorneys is investigating Vanderbilt University’s disclosed cybersecurity incident. We want to hear from people who used the Zerfoss Student Health Center or other Vanderbilt health services, submitted health-related information for university services, or worked on or participated in Vanderbilt research. We are reviewing privacy concerns, lost access, disrupted work, and response costs. This outreach does not establish that clinical or research records were exposed. Used Vanderbilt student health or health services, worked in a lab, or participated in a study? If you have a related privacy or access concern, contact Hall Attorneys for a case review. Students, employees, and others are also welcome. You do not need a notice or known financial loss to contact us. ## What has Vanderbilt University confirmed? Vanderbilt University announced an active cybersecurity incident on November 9, 2026. Its evening update said campus Wi-Fi was available, most university systems and applications remained restricted, and Student Care Network offices were open and holding appointments. Those are dated operational updates, not findings about exposed records or complete recovery. The notice lists suspicious activity for users to report. Those warning examples do not establish that files were actually encrypted, deleted, or stolen. The public notice does not identify a complete intrusion period, confirmed exposed data fields, or an affected-person total. November 9 is the disclosure date, not an established start date for unauthorized access. Sources: Vanderbilt University: Active cybersecurity incident update (November 9, 2026): https://news.vanderbilt.edu/2026/11/09/nov-9-active-cybersecurity-incident-updates/ ## What have users reported about files and research access? Nashville Scene reported that one individual described files being rewritten with a .byod extension, while another could no longer access research stored on university systems. These are attributed individual accounts, not findings about every device or research project. Those reports do not establish permanent data loss, the full scope of encryption, theft of research datasets, or access to a particular person’s information. We would like to hear from people with related file changes, inaccessible work, or documented response costs. Sources: Nashville Scene: Ransomware Attack Puts Vanderbilt on Lockdown (November 9, 2026): https://www.nashvillescene.com/news/pithinthewind/vanderbilt-university-cyber-attack-lockdown/article_c7136f1f-a103-4e75-93bc-826ca02e894e.html ## What does BYOD allege? RansomLook’s public index records a November 9 BYOD entry naming Vanderbilt EDU. The indexed actor text alleges locked databases, access to university and research data, more than 1 million Social Security numbers, contact information, and student and employee records. These claims remain unverified. The university’s notice does not confirm BYOD’s role, data theft, database encryption, or the claimed volume. A claimed count of Social Security numbers is not a verified count of affected people. We have not independently established which individuals or records, if any, were accessed. We are reviewing whether the facts support privacy or other legal claims, including a potential class action. An incident, enrollment, employment, or account restriction alone does not establish an individual claim or entitlement to compensation. Sources: RansomLook: BYOD listing metadata (November 9, 2026): https://www.ransomlook.io/group/byod Vanderbilt University: Active cybersecurity incident update (November 9, 2026): https://news.vanderbilt.edu/2026/11/09/nov-9-active-cybersecurity-incident-updates/ ## Student Health Center and Vanderbilt health-service users We invite inquiries from people who used the Zerfoss Student Health Center, Student Care Network, or other Vanderbilt health services, or supplied health-related information for university services. A notice or known financial loss is not required to contact us about a related concern. The Student Health Center’s official pages describe medical-record services through the Medical Center and My Health at Vanderbilt. The university and Vanderbilt University Medical Center are separate legal entities. Our review distinguishes clinical records from information held through university services rather than assuming the same systems hold every record. Vanderbilt Health issued a separate November 9 notice saying its own IT systems had not been impacted so far and patient care was continuing at its hospital and clinical locations. It advised employees not to access university IT resources or connect removable devices to university systems. That is a dated health-system statement, not an independent guarantee about every person’s records. This university investigation does not establish that Vanderbilt Health or Vanderbilt University Medical Center patient information was exposed. Receiving care there alone does not establish involvement in the university incident. The invitation to health-service users does not establish that clinical, counseling, or other health-related records were accessed. The Student Care Network website also reports that Student Affairs incident-reporting forms are temporarily unavailable and provides alternate contact instructions. A reporting-form interruption does not establish that a clinic is closed or that patient information was exposed. Use current official care and support channels rather than waiting for a legal review. Sources: Vanderbilt Health: Separate IT precautions and patient-care update (November 9, 2026): https://news.vumc.org/2026/11/09/alert-vanderbilt-health-employees-should-not-attempt-to-access-vanderbilt-universitys-it-resources-until-further-notice/ Zerfoss Student Health Center: Official service information: https://www.vumc.org/student-health/welcome Student Health Center: Confidentiality and medical-record communications: https://www.vumc.org/student-health/confidentiality-medical-excuses-e-mail-communication Vanderbilt University General Counsel: University and Medical Center distinction: https://www.vanderbilt.edu/generalcounsel/legal/faqs/ Vanderbilt University: Student Care Network and reporting-form update: https://www.vanderbilt.edu/student-care-network/ ## Researchers, laboratory staff, and research participants We also want to hear from faculty, graduate and postdoctoral researchers, laboratory staff, collaborators, and people who participated in Vanderbilt studies. Tell us about incident-related privacy concerns, lost access to research files or systems, interrupted work, or documented response costs. You do not need to prove permanent data loss before requesting a review. The university’s privacy policy lists student health records and research-subject information among its ordinary institutional information categories. That policy describes normal data handling; it does not identify records exposed in this incident. Research participation or inaccessible files alone do not establish that participant data, clinical information, or unpublished results were stolen. Describe the type of disruption in general terms. Do not send participant names, consent forms, study datasets, unpublished research, proprietary methods, or confidential grant materials in an initial inquiry. An authorized representative may contact us about a laboratory or organizational concern without submitting protected research. Sources: Vanderbilt University: Privacy policy and institutional information categories: https://www.vanderbilt.edu/privacy/ ## Who should contact Hall Attorneys? We would like to hear from current or former students, applicants, employees, contractors, health-service users, researchers, and research participants with an incident-related concern. Please contact us if you: - Received a university security notice or an incident-related account alert. - Observed unfamiliar access, suspicious messages using nonpublic details, or changes to your university records. - Experienced incident-related access restrictions or documented response expenses. - Used the Student Health Center or other Vanderbilt health services, or submitted health-related information for university services, and have a related privacy or access concern. - Lost access to research files or systems, observed unexpected file changes, or spent time or money responding to a research interruption. - Participated in university research or a university business relationship and have a relevant notice or privacy concern. You may begin with a general description. Do not disclose confidential research, participant identities, patient information, or an employer’s protected records. We will assess whether the evidence supports a connection to this incident rather than assuming every university relationship establishes exposure. ## What instructions has the university issued? The earlier November 9 notice requested device shutdowns and disconnection from university Wi-Fi; the evening update reported Wi-Fi available while most systems remained restricted. For suspicious devices, the university instructed users to avoid unfamiliar prompts and self-repairs, shut down, and contact IT from a separate device or telephone. Follow current official instructions before resuming use. The university’s status page currently warns that it is being rebuilt and that its displayed information should not be treated as accurate. Green indicators therefore do not establish restoration. Use the university’s incident updates and official IT channels for instructions. Requesting a legal review does not report a security issue to the university, restore an account, or replace urgent IT assistance. Do not delay protective action while awaiting a case review, and do not approve unexpected authentication requests or disclose credentials to an unsolicited contact. Sources: Vanderbilt University: Active cybersecurity incident update (November 9, 2026): https://news.vanderbilt.edu/2026/11/09/nov-9-active-cybersecurity-incident-updates/ Vanderbilt University: Status page and maintenance warning: https://status.vanderbilt.edu/ Vanderbilt University: Official Information Technology site: https://it.vanderbilt.edu/ ## What records should you preserve? Keep notices, original suspicious messages, relevant account alerts, support correspondence, and records of response costs. Note the dates of restrictions, unfamiliar activity, file changes, and lost research or health-service access. Preserve existing records you are authorized to access without turning on or reconnecting a device against university instructions. Do not investigate university systems yourself or obtain allegedly stolen files. Do not send Social Security numbers, passwords, authentication or recovery codes, student or employee identifiers, medical records, research data, or other people’s personal information in an initial inquiry. Describe the records first; we can discuss what is needed and an appropriate way to provide it. ## Contact Hall Attorneys about Vanderbilt University Provide your name, state or country of residence, a safe way to reach you, and your relationship to Vanderbilt. Tell us whether you received a notice and approximately when. You can describe a student, health-service, employment, researcher, or research-participant concern without providing confidential details. For an organizational inquiry, include your role. Briefly describe relevant activity, inaccessible records or research, service restrictions, and response expenses. You do not need to disclose why you sought health services, a diagnosis, treatment details, or a study’s confidential subject matter. Keep sensitive documents until we discuss what is needed. Let us know whether it is safe to leave a voicemail. Contact: Nicholas Hall, Hall Attorneys, P.C. Email: nhall@hallattorneys.com Phone: 713-428-8967 Request a Case Review: https://hallattorneys.com/connect Attorney Advertising. Responsible attorney: Nicholas Hall, Hall Attorneys, P.C., Edna, Texas. Hall Attorneys is not affiliated with Vanderbilt University, Vanderbilt Health, or Vanderbilt University Medical Center. This page describes an investigation, not a filed lawsuit by Hall Attorneys concerning this incident. Individual exposure, legal responsibility, and compensation have not been determined. It provides general information, not legal advice. Contacting the firm or submitting information does not create an attorney-client relationship. No outcome is guaranteed.