>

Cybersecurity Incident FAQs

  • If I notice any sort of suspicious activity on my VU-managed device, what should I do?

    If you see any abnormal or suspicious activity that you have not already reported, contact VUIT immediately by logging a ticket with the VUIT help desk. Abnormal activity may include but is not limited to unexpected pop-up messages, inability to access email and inability to move beyond a blue startup screen. The help desk phone is getting many, many calls, so submitting a ticket is the best method for reporting.

  • What systems and applications can I use now?

    The majority of systems and applications are available for use.

    Any system or application that should not be used is disabled and will generate an error message if you try to access it. This includes but is not limited to Box, Oracle Cloud, Salesforce, Peoplesoft and Microsoft Services including Sharepoint, Teams, OneDrive and web-based Microsoft applications that rely on those services (ex: online versions of Word, Powerpoint, Excel, etc.).

    Desktop versions of Microsoft products are enabled and can be used, but files cannot be saved to or accessed from cloud-based services like Box, OneDrive and Sharepoint. Files can only be saved locally on devices at this time.

    If you get an error message while trying to access a system or application, it is most likely because the platform is disabled, and not an indicator that your device has been compromised. If you see any other abnormal or suspicious activity while accessing a platform, log a ticket with the VUIT help desk.

  • Should I bring my computer into the VUIT Tech Hub?

    No. Do not bring your computer into the VUIT Tech Hub unless specifically instructed to do so. If you see any abnormal or suspicious activity that you have not already reported, log a ticket with the VUIT help desk. They will provide instructions specific to your situation. 

  • Was my personal information (SSN, banking, health, student records) accessed or stolen?

    Vanderbilt University Information Technology is continuing to assess the situation and determine what, if any, data may have been accessed. The university will continue to communicate updates.

  • Was research data, including IRB-protected or grant-funded data, compromised?

    Vanderbilt University Information Technology is continuing to assess the situation and determine what, if any, data may have been accessed. The university will continue to communicate updates.

  • Was Vanderbilt Health/VUMC affected?

    Vanderbilt Health (which is also known as Vanderbilt University Medical Center) and Vanderbilt University are legally and financially separate entities. Vanderbilt Health is taking the necessary precautions to ensure the security of their computer systems and are monitoring the situation at the university closely. We are addressing known issues that may be affecting employees shared between the two entities.

  • Are my personal devices compromised?

    No. We believe that any impacts are contained to Vanderbilt-issued devices.

  • Do I need to reset my VUnetID password?

    If a password reset is required, VUIT will communicate that proactively to those who will need to update their credentials. 

  • How is email okay and other Microsoft products are not?

    We have prioritized ensuring that Outlook email access is restored. We have disabled access to One Drive, Sharepoint and Teams. Many other Microsoft products use those services, which is why they are still unavailable. 

  • How do I know a Vanderbilt email or call about this incident is real?

    Official VU Alert emails and text messages are being sent through info@vupublicsafety.com. Be cautious of any message alleging to be official that does not come from this email address.

  • Where should I host my meetings while Teams is down?

    Zoom is available for meetings.

  • Will payroll go out on time?

    Yes. We are prioritizing critical business operations, and payroll is planned to go out on time.

  • My Outlook has asked me to sign back in, even though I didn’t sign out. Should I sign in?

    Access to OneDrive, SharePoint, Teams and other Microsoft services that rely on these platforms has been disabled. You may be prompted to sign in again, and you should do so, but these related platforms will not work at this time.

  • Is VERA OK to use?

    VERA is currently unavailable. We are working with the vendor to restore access. Faculty who have grant submissions due should contact Vice Provost for Research and Innovation Susan Margulies. That team can provide focused support to ensure timely submission.

  • What counts as “abnormal activity” now that I’m powering back on?

    Examples of suspicious activity include, but are not limited to:

    • Unexpected pop-ups, warnings or security notifications
    • Unusual changes to files, folders or permissions in OneDrive, Box or other cloud storage platforms
    • Files that have been unexpectedly moved, deleted, renamed or modified
    • Unfamiliar applications, messages or prompts appearing on your device
    • Unexpected requests to enter passwords, approve authentication requests or provide login credentials
    • Any other unexpected or unusual behavior on your device
  • If I see suspicious activity, such as audio pop-ups playing, is my computer compromised?

    Yes. Turn off your computer, then use another uncompromised device to submit a ticket with VUIT.

  • Is it now safe to work from my office computer?

    If you have not already reported issues to VUIT that have led to your computer being identified as compromised, you may use it, but only with the programs listed in these FAQs as approved for use. If you notice anything suspicious or abnormal while using your device, submit a ticket with the VUIT help desk.

  • My VU-managed computer at home cannot connect to the internet. Is that normal?

    VUIT is aware of affected devices and is working on remediation plans. If a specific action is required, it will be communicated directly to affected people.

  • The only device I can use to access the internet is a non-VU-managed device. Is that normal?

    VUIT is aware of affected devices and is working on remediation plans. If a specific action is required, it will be communicated directly to affected people.

  • My device was used on Monday and never shut down. Is it safe to use?

    If you have not already reported issues to VUIT that have led to your computer being identified as compromised, you may use it, but only with the programs listed in these FAQs as approved for use. If you notice anything suspicious or abnormal while using your device, submit a ticket with the VUIT help desk.

  • Is my OneDrive or Box data intact? Were my files deleted or encrypted?

    Vanderbilt University Information Technology is continuing to assess the situation. The university will continue to communicate updates.

  • Where can I check status updates in real time instead of waiting for updates?

    Community updates will be posted on the Vanderbilt website and social media.

  • Will reimbursements and vendor payments be delayed?

    The accounts payable team is working to ensure that payments are processed on schedule.

  • Are student billing and financial aid deadlines extended?

    Deadlines are continuing as planned at this time.