Ongoing Vanderbilt Hack Focused on Cloud Storage

An expansive network hack discovered at Vanderbilt University on Monday morning has infiltrated certain university cloud storage systems, such as Microsoft OneDrive and Box, leaving student and faculty research and coursework in jeopardy. The situation could take “multiple weeks” to resolve, according to the university. 

Since sending a campus-wide lockdown message on Monday, university IT has approved campus Wi-Fi, Zoom, email and printing, as well as cloud-based course management tool Brightspace, as safe to use according to its most comprehensive update shared Tuesday.

“VUIT continues to respond with a focus on containment and determining what data, if any, may have been accessed,” reads an official university update published Tuesday at 6 p.m. “We are making progress with containment measures and additional efforts to safeguard Vanderbilt systems. We anticipate it may take multiple weeks to fully restore normal operations across all systems. Systems and services will continue to be restored in a deliberate and secure manner as work progresses.”

Ransomware Attack Puts Vanderbilt on Lockdown

Vandy IT tells students and faculty to stay off network as university tries to contain hack

Some network users have reported encountering a robotic voice ordering that Vanderbilt comply with certain demands for relief from its ongoing cyberattack. The university missed a self-imposed Wednesday morning deadline to share its latest hack update. Vanderbilt declined to share with the Scene any existing hacker demands and directed all questions to a public “Active Cybersecurity Incident Updates” page.

A public website that tracks institutional cyberattacks lists Vanderbilt as the latest subject of "BYOD" attacks, which have plagued other universities and at least one hospital system. At least one employee recalls unexpected system updates, the common backbone of such attacks, running on a university computer on Monday morning. 

Raisa Rexer, a tenured professor of Romance languages, cultures and diasporas, is improvising her own tech security measures while she is unable to access critical course and research materials in cloud-based storage tools Box and OneDrive. She says some campus computers have been taken and some were left in classrooms, and handwritten IT guidance has been put on chalkboards. 

“I haven’t connected my laptop, which is a Vanderbilt device, to the internet since Sunday because the guidance has been so unclear,” Rexer says. “My colleague logged into a university computer yesterday to teach his class and it was corrupted, and he was under the impression that computers remaining inside the university were not corrupted. So I don’t want to risk it.”

Rexer is improvising her teaching based on her own handwritten notes she found on certain course material. She’s hosting a classroom speaker on her phone, rather than her computer, and asked that speaker to host the Zoom link via their institution. She still doesn’t know the fate of years of research she has in cloud storage, per Vanderbilt’s recommendation. 

“On Monday, minutes separated me from logging into the Vanderbilt Wi-Fi and not logging in — I saw the warning email on my phone so my computer never connected to the network,” Rexer says. “I was able to salvage very little downloaded onto my computer. The hardest thing has been zero updates about what the damage looks like in Box and whether we should prepare to have lost all our files and research.”

Update, 1:30 p.m.: On Wednesday afternoon, Vanderbilt issued an update that they are coordinating with law enforcement and government agencies. The university reiterated that it could take multiple weeks to restore normal operation. Representatives say they have prioritized business capabilities, like payroll and public safety, in their response. Also of note, one former Vanderbilt employee has filed a class-action suit against the school related to the cyberattack.