Summary
- Environment: University devices, systems and cloud services
- Operational impact: Selected services restored; other applications restricted
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 11, 2026; updated as evidence emerges.
What happened
Vanderbilt University acknowledged a cybersecurity incident November 9, 2026, and directed its community to shut down university devices and disconnect Wi-Fi. [1]
Impact
University work and communications were disrupted, while classes and registration continued on schedule. By November 10 evening, Wi-Fi, email, identity access, learning, enrollment, conferencing and printing services were available; other applications remained restricted. [1]
Timeline
Devices and systems restricted
Campus Wi-Fi returned that evening, while most systems stayed restricted.
[1]Selected services available
The university update warned full recovery could take multiple weeks.
[1]Briefing updated
This briefing was last reviewed and updated on November 11, 2026.
Threat Group & Attack Vector
The university had not established publicly what data, if any, was accessed. Its notices do not identify an attacker or entry method. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific ATT&CK technique is mapped from the available evidence.
Response
Vanderbilt worked with government agencies and other partners on containment. Device use resumed, with users asked to report suspicious activity. Full restoration remained in progress. [1]