Vanderbilt University confirmed on Thursday that hackers stole files containing personal information, including Social Security numbers, during a cyberattack on its Nashville campus network. A proposed class action over the breach was filed the same day in Nashville federal court.

In an update to students and staff, the university said a forensic review had found that data was taken from its systems before the intrusion was detected. It said it would notify affected people directly and offer them credit monitoring.

The attack became public on Monday, when Vanderbilt told students and employees to shut down university-issued devices and disconnect from campus networks. A ransomware group calling itself BYOD then claimed on its leak site that it had stolen more than one million Social Security numbers. The university did not confirm that figure. It said the number of people affected had not yet been determined.

The lawsuit was filed in the US District Court for the Middle District of Tennessee on behalf of a former student. The complaint accused Vanderbilt of failing to adequately protect sensitive records and to encrypt them.

It sought damages for current and former students, employees and applicants whose information was exposed. Data-breach class actions are routinely filed within days of a ransomware group publicising stolen records, according to plaintiffs' lawyers who specialise in privacy litigation.

Vanderbilt said it had notified the FBI and brought in outside cybersecurity specialists to contain the attack and restore services. Several systems, including parts of its email and learning platforms, remained offline on Thursday, the university said.

It told staff that it would not discuss whether it had been contacted with a ransom demand. Federal agencies, including the FBI and the Cybersecurity and Infrastructure Security Agency, have long advised victims against paying ransoms.

Universities have become frequent ransomware targets because they hold large stores of personal and financial data, often across decentralised networks. Under Tennessee's data breach notification law, Vanderbilt must inform affected state residents without unreasonable delay once it identifies them. The university said it would publish further updates as its investigation progressed.