A cyberattack put Vanderbilt’s information at risk. The university’s silence has put its community in the dark.
On Nov. 9, Vanderbiltconfirmeda cybersecurity breach and instructed community members to shut down university devices and disconnect from campus Wi-Fi. The ransomware group BYODclaimedresponsibility for the attack, alleging it had obtained sensitive university data. Vanderbilt has not verified those claims. Asthe Vanderbilt Hustlerreported, the university’s response has largely focused on containing the attack and restoring systems.
The first responsibility of an institution facing a crisis is to help the people affected by it. At Vanderbilt, those people are students, faculty and staff who have been asked to navigate a cybersecurity attack with little understanding of its scope or potential consequences.
The university’s updates have largely centered onoperational instructions: which devices to shut down and what applications are safe to use or should be avoided. Those instructions are necessary. But they do little to address the questions that have emerged alongside the disruption. Has personal information been accessed? What does Vanderbilt know about the extent of the breach? How will the university notify those affected? When can students, faculty and staff expect answers?
Although access to certain university systems has been resolved, the questions facing the people who rely on them have not. Students, faculty and staff deserve to know whether their information is secure, how the disruption will affect their work and education and what the university intends to do next.
VUITis responsible for containing the attack and restoring services. But explaining the incident and addressing its consequences for the university community requires leadership beyond the IT department. That responsibility ultimately falls to Chancellor Daniel Diermeier, whose absence from the university’s public response raises a larger question about Vanderbilt’s leadership during this crisis.
The need for such communication was apparent even to universities outside Vanderbilt. After news of the attack became public, Jen Stedelin, Washington University in St. Louis’s Interim Vice Chancellor and Chief Information Officer, sent a message to the WashU community acknowledging the incident, outlining precautionary measures and explaining that WashU was monitoring its own systems.
WashU recognized that an attack affecting another university warranted a response to its own community. Diermeier has yet to offer the Vanderbilt community a comparable acknowledgment.
Instead, much of the information circulating among students, faculty and staff has come through word of mouth, forcing community members to rely on the campus grapevine to make sense of an unfolding situation. We should not have to piece together information about an attack this serious through rumors, secondhand accounts and scattered operational updates.
Vanderbilt’s Nov. 10updateacknowledged that efforts to contain the attack had restricted the university’s standard communications. Although this update may explain some of the difficulty in distributing information, it does not excuse the absence of a more substantive response. If the university’s usual channels are unavailable, it must find alternatives. If investigators cannot yet answer certain questions, the administration should explain those limitations and commit to providing updates as soon as information becomes available.
The consequences of the attack may extend far beyond the temporary loss of university services. BYOD, the ransomware group claiming responsibility, hasallegedthat it obtained extensive university data, including personal information belonging to students and employees. Vanderbilt has not independently verified those claims. But the possibility that such information was accessed makes the university’s lack of substantive communication all the more concerning.
Students, faculty and staff have almost no way to determine if their information has been accessed and what protections they should take. The university should explain how and when it will notify affected individuals whose sensitive information was compromised.
Communication should not end when the immediate disruption, specifically to university resources, subsides. Vanderbilt must provide a substantive account of the attack.
Vanderbilt regularly establishesexpectationsfor its community members. Students are held toacademic and conduct policiesand faculty and staff are expected to meetprofessional and institutional obligations.
The university should be held to its own standards.
Vanderbilt may not yet have all the answers. But it can explain what it knows, acknowledge that certain aspects remain uncertain and establish a clear commitment to keeping students, faculty and staff informed. That is not an unreasonable expectation during an ongoing investigation. It is a basic responsibility of the institution.
