Abstract:
Vanderbilt University, a well-known American university, recently encountered a serious cybersecurity incident. The school said it is currently responding to an ongoing cybersecurity incident that may affect school equipment, internal systems and multiple cloud services. In order to reduce the risk, the school has urgently required students, teachers and other staff to turn off school-issued devices, disconnect the campus wireless network, and pay close attention to whether there are abnormalities in the equipment.
The school said in a statement that the information technology team is actively investigating the cause of the incident and taking measures to curb the spread of the impact. The school also reminds teachers and students to be vigilant and report any suspicious activities immediately. The abnormal signs listed by the school include unexpected pop-ups, security warnings, abnormal changes in files or permissions in the cloud storage platform, files being deleted or renamed for no reason, unfamiliar applications on the device, and abnormal authentication requests.
The school particularly emphasizes that if suspicious situations are discovered, users should not click on any unknown links, pop-up windows or attachments, and should not try to investigate and fix the problem on their own, to avoid further expanding the risk.
According to the Vanderbilt University student media "Vanderbilt Hustler", after the incident, staff from the school's information technology department entered multiple classrooms and reminded teachers to suspend the use of school-issued equipment. The school also advises teachers and students to close all Microsoft Word documents in use and stop accessing online storage directories such as OneDrive and Dropbox.
Despite the cyber attack, the school said teaching activities will continue as planned. The school announced that courses will continue as usual and students should arrange their studies according to the specific guidance of teachers. At the same time, the Student Care Network office remains open, and psychological counseling and other services also maintain normal operations.
At the same time, a ransomware group called BYOD claimed responsibility for the attack. The group claimed in public information that it had successfully breached school networks and stolen a large amount of sensitive data, including Social Security numbers, names, email addresses, phone numbers, and student and employee records.
The BYOD organization further claimed that it has mastered all the school's network environment and scientific research data, and claimed that the data obtained contained more than 1 million social security numbers. The organization also said that the school database has been locked, the attackers have mastered a large number of assets and information in the network, and requested to establish a communication channel with the school.
During the attack, multiple students and teachers reported that ransomware related to the BYOD organization appeared on school devices. A video circulating on the Internet shows a campus computer automatically playing a voice warning, saying that the system has been compromised by the organization.
However, so far, the content disclosed by the attacker group has not been independently confirmed. The student media "Vanderbilt Hustler" stated that it is temporarily unable to verify the organization's claims about the scale and content of the data theft.
The latest update from the school shows that the campus wireless network and core digital services such as Brightspace and YES are still in normal use. However, some online storage platforms still present security risks, so the school does not recommend that students log in to any Microsoft service account when receiving an authentication request to prevent their credentials from being stolen.
As for when the incident will be completely resolved, the school said it is currently unable to provide a clear timetable. The school plans to continue to release follow-up updates and will regularly update the campus community on the findings of the investigation. A school official described the cyber attack as "like a building suddenly exploding, and we are trying to collect and piece together all the pieces" to highlight the complexity of incident handling.
Comments