The most recent cyber attacks in the United States hit a major university, a New York City library system and critical infrastructure. A ransomware gang claims it stole data from Vanderbilt University after a campus-wide shutdown on November 9, 2026. Queens Public Library is still rebuilding after an attack that began on November 4, 2026. Federal agencies also warned on November 5, 2026 that hackers are targeting industrial refrigeration systems, including units on U.S. military bases.
Here is what is confirmed, what is only claimed, and what you can do now.
Vanderbilt University Ransomware Attack: What We Know
On the morning of November 9, 2026, Vanderbilt told students, faculty and staff it was responding to an active cybersecurity incident. The university asked everyone to shut down devices, disconnect from campus Wi-Fi and watch for suspicious activity. Students scrambled for internet access, and the attack also disrupted spring class registration. The registration window closes Friday, November 13.
Vanderbilt restored Wi-Fi on the night of November 9. By November 10, it had brought back email, Zoom, Brightspace, Okta and enrollment services. The university said other systems and applications remained restricted.
The BYOD ransomware group has claimed responsibility. The gang says it encrypted databases and stole more than 1 million Social Security numbers, along with names, emails, phone numbers and student and employee records. Vanderbilt has not confirmed what data was taken or whether it paid a ransom. Treat the numbers as the criminals’ claim for now.
BYOD appeared in September. It has also claimed attacks on Michigan State University and the University of New Mexico Health Sciences Center. The New Mexico attack, reported around October 26, 2026, disrupted patient care and surgeries. Vanderbilt’s official incident updates are the best place to track what the university confirms.
Queens Public Library Ransomware Attack
Queens Public Library, which serves roughly 2.3 million New Yorkers, confirmed a ransomware attack on Wednesday, November 4, 2026. The attack encrypted systems across the network. It knocked out the library’s website, mobile app, public computers, Wi-Fi, checkout machines and digital media services.
All 66 branches stayed open. Staff worked around the outage, and the library restored free Wi-Fi and checkout and return machines at open locations by November 10. No full restoration date has been announced, and the library has not said whether patron data was exposed.
Libraries make easy targets. They run lean IT teams and hold large amounts of patron information. Toronto Public Library took roughly four months to recover from a 2023 attack, and Seattle Public Library needed weeks after a 2024 incident. Queens patrons should be ready for a slow, partial return of online services.
Hackers Target Industrial Freezers, Including Military Bases
This is the strangest of the most recent cyber attacks, and one of the most serious. On November 5, 2026, CISA, the FBI and the Departments of Agriculture, Health and Human Services and Transportation issued a joint warning of an “ongoing cyber threat” to industrial refrigeration. CISA’s joint advisory on refrigeration and cold chain systems says hackers are compromising internet-connected cooling and monitoring equipment.
The targets include grocery stores, cold storage facilities and the food, transportation and medicine-shipping industries. Attackers who gain control could change temperatures. The agencies warn that this could cause fire hazards, lost inventory and shortened equipment life.
The campaign reaches well beyond the U.S.:
- Waves of attacks across Europe have spoiled food in at least a dozen countries.
- Hackers targeted a French blood bank, but defenders stopped them before donated blood was compromised.
- The Pentagon is investigating suspected hacks of freezers on military bases.
- Some affected remote-controlled units came from a manufacturer that had stopped issuing security updates.
The U.S. government has not officially blamed any group or country. Security researchers have broadly pointed to Iran, and U.S. officials reportedly suspect it. That remains unconfirmed.
Federal agencies recommend taking refrigeration controls off the public internet, changing passwords, patching where possible and retiring unsupported equipment. Store owners should check whether their cooling systems can be reached remotely.
Maersk Data Breach and the $5 Million Ransom Demand
Shipping giant Maersk confirmed that an attacker broke into a legacy system it inherited through an earlier acquisition and copied data. The WhiteArmor ransomware gang listed Maersk on its leak site over the weekend of November 7-8, 2026. It demanded $5 million and claims to hold about 100 GB of data from a logistics platform.
Maersk says its evidence so far shows no sensitive data has been disclosed. It has not described the affected system or the type of data involved. The investigation is ongoing, so the gang’s 100 GB figure and its claims about driver records and passwords remain unverified.
The case shows a common weak point. Attackers often skip a company’s main network and go after older systems left over from acquisitions.
Other Recent Cyber Attacks and Breaches to Know
Several other incidents have added to the list in recent weeks.
- Turning Stone Resort Casino (Verona, New York): The casino went cash-only after a cybersecurity incident reported on November 2, 2026.
- Toyota: BYOD claimed on November 10, 2026 that it obtained customer personal information. That claim is unverified, and Toyota’s systems may not have been breached.
- Ivanti Connect Secure: CISA warned on October 14, 2026 that attackers were exploiting a zero-day flaw in the VPN product. Exploitation dates back to at least October 1. The agency told organizations to patch immediately.
- Pentagon data breach: A breach at the Defense Manpower Data Center was reported on October 1, 2026. The Defense Department notified affected individuals.
- Chinese-linked campaigns: A joint advisory on October 8, 2026, backed by the FBI, CISA, NSA and partner agencies abroad, described Chinese government-linked actors exploiting outdated, unsupported software.
One breach tracker counted roughly 500 disclosed incidents in a single week in November, with ransomware claims making up most of them. Many involved small organizations that never reach national headlines.
Why Ransomware Keeps Hitting Universities, Libraries and Hospitals
Universities and libraries share a few traits that attackers exploit:
- Thousands of personal devices connect to open networks.
- IT staff are often spread thin or decentralized.
- Systems hold large amounts of identity data on students, employees and patrons.
- Downtime carries immediate costs, which pressures victims to pay.
Security experts also note that the academic calendar gives attackers leverage. Every day offline during a semester costs a school more, and criminals know it. The same logic applies to hospitals, where outages can delay care.
How to Protect Yourself After a Data Breach
If you attend Vanderbilt or Michigan State, use the New Mexico health system or the Queens library, or you get a breach notice from any organization, act quickly.
- Change passwords for the affected account and anywhere you reused it. Use a password manager.
- Turn on multi-factor authentication, preferably with an authenticator app instead of text messages.
- Freeze your credit at Equifax, Experian and TransUnion. It is free and blocks new accounts opened in your name.
- Watch bank and card statements closely for the next several months.
- Be wary of unexpected emails and calls. Scammers often use breach news to pose as the affected organization.
- Report identity theft at IdentityTheft.gov to build a recovery plan.
If you lose money to a cyber crime, file a report with the FBI’s Internet Crime Complaint Center. Prompt reports can help investigators connect cases.
What to Watch Next
Several storylines may develop in the coming days and weeks:
- Vanderbilt: Whether the university confirms that Social Security numbers were stolen, and whether BYOD leaks data if talks stall.
- Maersk: Whether WhiteArmor publishes the files it claims to hold.
- Queens Public Library: The timeline for restoring the website, app and digital media, and any word on patron data.
- Refrigeration attacks: Whether the U.S. government names a responsible party and whether more U.S. grocery or cold storage sites report problems.
Attacks tend to be reported quickly and then revised. Early claims from ransomware gangs often turn out exaggerated, and some turn out accurate. Official statements from victims and agencies are the most reliable guide.
Have you received a breach notice or noticed disruptions near you? Share your experience in the comments, and check back as these stories develop.