On 10 November 2026 the BYOD ransomware group added an organisation named "Providence" to its data leak site. The group claims to have stolen 25GB of personal data, including Social Security numbers, and says it chose not to encrypt the network. This is still only the group's claim. Providence has made no public statement, no regulator filing or breach notification has been published, and nobody has independently checked a sample of the data. The listing also does not prove which "Providence" the group means. HIFY Radar and HookPhish describe the victim as the US nonprofit health system. Breach House files the same entry under "Services". The listing should be treated as unverified until Providence or a regulator says otherwise.
What Happened
Threat-intelligence trackers picked up the leak-site entry on 10 November. Breach House says it indexed the entry that day and captured a screenshot from the group's leak site. HookPhish gives the same date for the alleged breach and for its discovery. In the posted message, BYOD says it has "sufficient access" to lock the network but has not done so, "to show how nested our access is". It also tells the victim to contact the group through the leak site's contact tab.
The key open question is whether the victim is really the health system. "Providence" is a common name in US organisations:
- HIFY Radar calls the victim "a U.S. nonprofit healthcare system". Its account rests on two posts on X, from the DailyDarkWeb and DarkWebInformer accounts. HIFY also notes that neither post shows the data came from Providence.
- HookPhish lists the sector as healthcare.
- Breach House lists the victim as a US company in "Services" with more than 1,000 employees. It gives no detail that points to a hospital operator.
- Siberpol reports on a separate Providence incident: the Interlock ransomware group listed Providence Academy, a school, back in December 2025. That incident has nothing to do with this one, and readers should not mix the two up.
At the time of writing, Providence has not commented and has not confirmed or denied any incident. No filing has appeared on the US Department of Health and Human Services breach portal.
What Was Taken
According to BYOD's own post, the data includes:
- 25GB of personal information
- Full names, email addresses and home addresses
- Dates of birth
- Social Security numbers
- "Much more", which the group does not describe
No outlet has reported whether a sample was published, and the group has not given a record count. The post does not mention medical or patient records specifically. If the claim is real and the victim is the health system, names, dates of birth and SSNs together are enough to commit identity fraud. Until the files are examined, nobody knows whose records they are: patients, staff or someone else entirely.
Why It Matters
BYOD is new but moving quickly. CyberXTron, a cyber risk firm quoted by WSMV and the Davidson County Herald, says the group first appeared in September 2026 and follows a pattern of stealing data and then leaking it to pressure victims. SC Media describes it as a ransomware-as-a-service operation.
The group's other recent claims show how fast it is moving:
- Trump Mobile (October 2026): SC Media, citing The Register, reports that BYOD leaked the personal details of 3,615 customers, including names, phone numbers, home addresses and order details.
- Vanderbilt University (9 November 2026): BleepingComputer reports that Vanderbilt confirmed an "active cybersecurity incident" and told staff and students to shut down university devices. BYOD claimed it encrypted the university's databases and stole more than 1 million SSNs. WSMV reports that the group's name could be heard in a video that played on infected devices. Vanderbilt has not confirmed that BYOD was behind the attack or that any data was stolen. The Davidson County Herald reports that classes went ahead as normal on 10 November, while many university systems stayed restricted.
The Providence listing appeared the day after Vanderbilt. That suggests the group is moving straight from one victim to the next. Its Vanderbilt claim, at least, matched a real disruption. Unlike at Vanderbilt, though, BYOD says it did not encrypt anything at Providence. That makes the case harder to judge from the outside, because there is no visible outage to confirm or rule out the claim.
The Attack Technique
Nobody has said how BYOD would have got into Providence. The best guide is the Trump Mobile case. SC Media reports, based on The Register, that BYOD got in through an employee of Liberty Mobile, the company that runs the Trump Mobile network. The group says it infected that employee's machine with an infostealer, malware that steals saved passwords and login sessions. BYOD also claims neither company used multi-factor authentication. Those details come from the attacker and have not been confirmed.
At Vanderbilt, the warning signs the university listed included unexpected login prompts, odd permission changes in cloud storage, and unfamiliar applications. That points to an attacker using stolen identities and abusing cloud services, not just encrypting on-site servers. BYOD claimed it had taken full control of Vanderbilt's domain controller, the server that manages user accounts and logins.
What Organizations Should Do
- Hunt for infostealer infections. Check endpoint detection logs for known stealer malware families. Watch dark-web and stealer-log monitoring for your company's domains. Reset passwords and revoke active login sessions for any affected user.
- Require phishing-resistant MFA everywhere. That includes staff at contractors and outsourcing partners who can reach your systems, since BYOD's Trump Mobile entry point was a third party.
- Watch identity and cloud audit logs. Look for new MFA devices being registered, impossible-travel logins, mass file permission changes, and any unexpected changes to domain controllers or admin groups.
- Treat "we didn't encrypt" as a live intrusion. If you are named and the group says it still has access, assume it does. Find out how it got in and remove that access before you engage with the group.
- Check leak-site claims before you act on them. Healthcare organisations that share a name with a listed victim should confirm whether they are the target and prepare holding statements. Patients and staff will contact the wrong organisation.
- Get breach notification ready. US health providers have 60 days under HIPAA to notify affected people once a breach is discovered. Start working out what data is in scope now, not after files are published.
Sources: Providence Data Breach: Byod Ransomware Claim (Nov 2026) | Vanderbilt University hit in BYOD ransomware attack, data theft cla... | Ransomware group BYOD claims Trump Mobile data breach brief SC Media | Providence — BYOD Ransomware Attack Breach House | BYOD claims theft of Providence personal data HIFY Radar | Providence Academy data allegedly leaked by interlock | Vanderbilt University responds to cybersecurity breach | BYOD claims data theft in Vanderbilt breach Davidson County Herald