Vanderbilt University students, employees and others whose personal information may have been exposed in the November 2026 cyberattack on Vanderbilt’s systems may be covered by a proposed class action alleging the university failed to protect that data. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Vanderbilt University has not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
A proposed class action was filed on Monday, November 9, 2026, in the U.S. District Court for the Middle District of Tennessee in Nashville, the same day Vanderbilt University discovered a cyberattack on its systems. The plaintiff is described in news reports as a former Vanderbilt student, employee, or both. The complaint alleges that Vanderbilt was “grossly negligent” in protecting personal information, kept sensitive data unencrypted and failed to follow basic federal cybersecurity standards, according to NewsChannel 5 and the Nashville Banner. Vanderbilt has not responded to the allegations in court, and no judge has ruled on them. A case number has not been reported.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Happened in the Vanderbilt Cyberattack?
The attack was discovered on the morning of November 9. According to the Nashville Scene, it reached university cloud storage systems, including Microsoft OneDrive and Box, and campus Wi-Fi was disrupted the same day, according to The Vanderbilt Hustler. On November 10, Vanderbilt said it was working with federal law enforcement and outside cybersecurity firms, was still determining what data, if any, may have been accessed, and anticipated it “may take multiple weeks to fully restore normal operations across all systems.” On November 12, the university required everyone in the Vanderbilt community to reset their passwords, the Hustler reported.A ransomware group calling itself BYOD claimed responsibility and says it stole more than one million Social Security numbers along with names, email addresses, phone numbers and student and employee records. Those claims are the group’s own and have not been confirmed by Vanderbilt or by the news outlets covering the attack. None of the reports reviewed for this page says Vanderbilt University Medical Center’s systems were involved.
What Does the Lawsuit Ask For?
The complaint seeks money damages for the proposed class, court-ordered improvements to Vanderbilt’s data security, annual security audits and lifetime credit and identity theft monitoring paid for by the university, and it demands a jury trial, according to NewsChannel 5 and the Nashville Banner. The proposed class definition has not been published in the coverage reviewed here, but data breach complaints typically propose a class of everyone whose information was exposed in the incident.What Happens Next?
Vanderbilt will respond to the complaint, often with a motion to dismiss. When a breach leads to several lawsuits, they are usually combined in one court. If Vanderbilt confirms that personal data was taken, it would send breach notices to affected people, and those notices would say what information was involved. Any payment to class members would come only from a later settlement or judgment approved by the court.Questions
Did Vanderbilt confirm that Social Security numbers were stolen?
No. As of November 12, 2026, Vanderbilt said it was still determining what data, if any, may have been accessed. The claim that more than one million Social Security numbers were stolen comes from the ransomware group BYOD and has not been confirmed.
Who filed the Vanderbilt cyberattack lawsuit?
A former Vanderbilt student and employee, according to news reports, filed the proposed class action on November 9, 2026 in the U.S. District Court for the Middle District of Tennessee. The plaintiff seeks to represent others whose information was exposed.
Is Vanderbilt University Medical Center part of the lawsuit?
The coverage reviewed for this page describes the attack and the lawsuit as involving Vanderbilt University’s systems. None of it says Vanderbilt University Medical Center, a separate organization, was affected.
Can I file a claim in the Vanderbilt data breach lawsuit?
No. The case is a proposed class action at the complaint stage. No class has been certified, there is no settlement and there is no claim form. A claim process exists only if the case settles or wins and a court approves notice to class members.
Sources
- NewsChannel 5: First class-action lawsuit filed against Vanderbilt University (Nov. 2026)
- Nashville Banner: Vanderbilt faces a class action suit after cyberattack (Nov. 12, 2026)
- The Vanderbilt Hustler: live coverage of the cyberattack (Nov. 9–12, 2026)
- Nashville Scene: Ongoing Vanderbilt hack focused on cloud storage (Nov. 11, 2026)
