---
title: "Vanderbilt University systems incident"
description: "Vanderbilt restricted devices and systems during a cybersecurity incident and anticipated several weeks for full operational recovery."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-11"
canonical_url: "https://www.ally.security/incidents/vanderbilt-university-systems-incident-2026"
markdown_url: "https://www.ally.security/incidents/vanderbilt-university-systems-incident-2026.md"
stix_url: "https://www.ally.security/incidents/vanderbilt-university-systems-incident-2026/stix.json"
---

# Vanderbilt University systems incident

Vanderbilt restricted devices and systems during a cybersecurity incident and anticipated several weeks for full operational recovery.

Last modified Nov 11, 2026 · 1 source

## Summary

- **Environment:** University devices, systems and cloud services
- **Operational impact:** Selected services restored; other applications restricted
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Vanderbilt University](https://www.vanderbilt.edu/) acknowledged a cybersecurity incident November 9, 2026, and directed its community to shut down university devices and disconnect Wi-Fi. [1](#source-1)

## Impact

University work and communications were disrupted, while classes and registration continued on schedule. By November 10 evening, Wi-Fi, email, identity access, learning, enrollment, conferencing and printing services were available; other applications remained restricted. [1](#source-1)

## Timeline

### November 9, 2026 — Devices and systems restricted

Campus Wi-Fi returned that evening, while most systems stayed restricted. [1](#source-1)

### November 10, 2026 — Selected services available

The [university update](https://news.vanderbilt.edu/2026/11/09/nov-9-active-cybersecurity-incident-updates/) warned full recovery could take multiple weeks. [1](#source-1)

### November 11, 2026 — Briefing updated

This briefing was last reviewed and updated on November 11, 2026.

## Threat Group & Attack Vector

The university had not established publicly what data, if any, was accessed. Its notices do not identify an attacker or entry method. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific ATT\&CK technique is mapped from the available evidence.

## Response

Vanderbilt worked with government agencies and other partners on containment. Device use resumed, with users asked to report suspicious activity. Full restoration remained in progress. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/vanderbilt-university-systems-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Active Cybersecurity Incident Updates

official · Vanderbilt University · Nov 9, 2026

<https://news.vanderbilt.edu/2026/11/09/nov-9-active-cybersecurity-incident-updates/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Occurred At · 100% confidence · current**  
   Selected services available; broader recovery expected to take weeks: 2026-11-10
2. **Resulted In · 100% confidence · current**  
   Vanderbilt University systems incident: Classes and course registration continued on schedule despite disrupted university work and constrained communications.
3. **Resulted In · 100% confidence · current**  
   Vanderbilt University systems incident: Vanderbilt anticipated multiple weeks to restore normal operations across all systems. It was working with government agencies and partners, focusing on containment and determining whether data had been accessed.
4. **Disclosed At · 100% confidence · current**  
   Vanderbilt University systems incident: 2026-11-09
5. **Affected Organization · 100% confidence · current**  
   Vanderbilt University systems incident: Vanderbilt University
6. **Resulted In · 100% confidence · current**  
   Vanderbilt University systems incident: University restricts devices and systems
7. **Resulted In · 100% confidence · current**  
   Vanderbilt University systems incident: Selected services available; broader recovery expected to take weeks
8. **Resulted In · 100% confidence · current**  
   Vanderbilt University systems incident: Campus Wi-Fi returned November 9. By November 10 evening, email, Okta, Brightspace, Zoom, enrollment services and CampusPrint were available; other applications remained restricted and university devices could be used again.
9. **Occurred At · 100% confidence · current**  
   University restricts devices and systems: 2026-11-09
10. **Resulted In · 100% confidence · current**  
   Vanderbilt University systems incident: Vanderbilt acknowledged an active cybersecurity incident November 9 affecting university devices, systems and cloud services, and directed its community to shut down university devices and disconnect Wi-Fi.

</details>