The ransomware group BYOD says it has compromised the Texas Health and Human Services Commission (HHSC). HHSC is the state agency that runs Medicaid, SNAP, TANF and other public assistance programs. On November 9, 2026, the group posted the agency on its dark web leak site and claimed it holds data on about 2 million Texas residents. That would be far larger than an earlier agency incident, which the group puts at roughly 94,000 records. The claim is unverified. HHSC has not commented publicly. The agency has not confirmed an intrusion, and no new regulator filing has been published. No one has independently confirmed that the group took any data. The listing appeared during a busy week for BYOD. Within days the same group also claimed attacks on Vanderbilt University and the University of New Mexico Health Sciences Center, and both of those institutions have confirmed real disruption.
What Happened
Ransomware.live, which tracks extortion leak sites, recorded the BYOD listing titled "Texas HHSC" on November 9. The threat intelligence firm ThreatMon and the monitoring account DarkWebInformer also reported it, and DarkWebInformer noted that BYOD had named Vanderbilt University in Nashville at about the same time. HIFY Radar reports that about nine hours later, early on November 10 UTC, another account spread the claim and tagged the Texas Tribune, Senator Ted Cruz and the agency itself.
The text of the post, as captured by ransomware.live, reads in part: "So much for firing your employees for leaking ~94k records, the true flaw remained in your system leading to the whole program being compromised, it's actually laughable, 2 Million Texas Citizens, Medicaid, Banking Information, SNAP, TANF, Disaster Assistance... the whole program." It closes by telling the agency to make contact through the group's site.
The post points to an earlier incident, and the figures for it don't line up. BYOD and HIFY Radar describe a previous leak of about 94,000 records that ended with employees being fired. Separately, a breach report HHSC filed with the US Department of Health and Human Services Office for Civil Rights on January 5, 2026, as indexed by BreachTally, lists 68,066 affected individuals. It records a "Hacking/IT Incident" involving a network server and the exposure of medical and health information. It is not clear whether the 94,000 figure and the 68,066 filing describe the same event. The group's "~94k" is its own characterisation. The 68,066 count is the only figure on the public record, from the agency's own filing.
According to Yazoul's review of the leak post, BYOD did not include sample files, a data volume figure or any other proof of compromise. Undercode News and Yazoul both stress that nothing so far shows whether the group got access, took data or encrypted any HHSC systems.
What Was Taken
What was taken has not been established. If the group's claims are accurate, the exposed data would include:
- Records on about 2 million Texas residents, according to BYOD. No outside party has confirmed this figure.
- Medicaid information, which could include health and eligibility data.
- Banking information, likely payment or benefit disbursement details, though the post does not say.
- Records from SNAP, TANF and Disaster Assistance programs.
Benefits data of this kind usually combines Social Security numbers, dates of birth, household makeup, income, health conditions and bank details for people who are often low-income, elderly or disabled. Taken together it is a strong toolkit for identity theft, benefits fraud and targeted phishing. The groups most exposed are also the least able to absorb the losses.
The gap between the numbers is the central open question. If the claim is real, the 2 million figure would be about 29 times the 68,066 people in the agency's January filing, and more than 20 times the 94,000 the group cites. Without samples, defenders and residents cannot tell whether this is a new and larger compromise, a recycled version of the earlier incident, or an inflated claim.
Why It Matters
BYOD is new, and it is getting noticed quickly. BankInfoSecurity calls BYOD "a relatively new threat actor," and Yazoul says there is little public research on the group: no confirmed victim tally, no documented tooling and no technical analysis of its malware. A short track record is a good reason to be sceptical of any single claim. The Texas listing, however, is part of a run of attacks in which other victims have confirmed real damage:
- University of New Mexico Health Sciences Center. BankInfoSecurity reports that a cyberattack forced New Mexico's only Level-1 trauma center to divert ambulances, suspend outpatient surgeries and cancel classes. BYOD claimed it had compromised 36,000 devices across UNM's campus and hospital. The group later offered a free decryption key for hospital systems, saying it did not know the machines were "assisting patients in real time." It also said it would keep the stolen data, and offered affected patients up to $2,500 each.
- Vanderbilt University. DataBreach.com reports that Vanderbilt told students and staff to shut down university devices and get off campus Wi-Fi during "an active cybersecurity incident." BYOD claims it took over a domain controller and holds more than 1 million Social Security numbers. The student newspaper, the Vanderbilt Hustler, reported that university IT confirmed a breach to the paper but not what the gang says it took.
Taken together, BYOD's attacks on other institutions have caused real disruption, so its Texas claim cannot be dismissed. Its offer to pay patients is unusual. It turns victims into a pressure point and suggests the group uses publicity aggressively.
Public benefits agencies are big targets. State human services agencies hold eligibility and payment data for millions of people. Much of it is reached through connections to contractors, county offices and outsourced call centres. The group's own post blames a "true flaw" that survived the earlier staff firings, which suggests it believes the agency fixed the people problem but not the underlying weakness that let the earlier data out.
The regulatory consequences can be serious. BankInfoSecurity notes that federal regulators recently reached an $800,000 settlement with a Pennsylvania health system over HIPAA failures linked to a 2023 ransomware attack. HHSC already has a 2026 breach report on file with the Office for Civil Rights. A second, larger incident would invite close scrutiny of what it changed after the first.
The Attack Technique
How BYOD got in, if it did, is unknown. The group has not described its method for HHSC, and no forensic details, indicators of compromise or detection signatures specific to BYOD are public.
What can be pieced together from the group's other attacks:
- Encryption plus data theft. At UNM and Vanderbilt, BYOD claimed to have both locked systems and stolen data. That matches the standard double-extortion model, and in both cases it is backed by confirmed operational disruption.
- Taking over Active Directory. At Vanderbilt, BYOD claimed "full takeover of your DC." A domain controller manages logins and permissions across a Windows network, so control of it gives access to nearly every account and machine. A claim of 36,000 compromised devices at UNM also points to deployment across the whole domain rather than a single server.
- Contact through encrypted messaging. BYOD directs victims to the "contact tab" on its leak site and to the Session messenger.
For HHSC, the group's reference to a flaw left over from the earlier insider-related leak hints at a weakness in access controls or data-handling processes rather than a single exploited vulnerability. That is the group's framing and has not been confirmed.
What Organizations Should Do
- Protect Active Directory as if BYOD were already inside. Audit domain admin and other privileged group membership, apply a tiered admin model, rotate the KRBTGT account password twice, and alert on new domain admins, DCSync activity and changes to Group Policy. BYOD's claimed domain controller takeovers make this the first priority.
- Fix root causes after insider or leak incidents, not just personnel. If staff were fired over a data leak, check whether the access they abused still exists for others. Look at overly broad database permissions, shared service accounts, bulk export rights and gaps in monitoring of mass record queries.
- Watch for bulk data movement out of benefits and eligibility systems. Set baselines for normal query volumes on Medicaid, SNAP and TANF databases. Alert on large exports, unusual archive creation and outbound transfers to cloud storage or file-sharing services.
- Check third-party and contractor access. State benefits programs rely heavily on vendors, counties and call centres. List every external connection into eligibility systems, require phishing-resistant MFA, and remove access that is stale or used only rarely.
- Prepare for a claim before any proof arrives. Have a playbook ready for unverified leak-site listings: quick checks of logs for the claimed systems, a coordinated statement, and early contact with regulators and law enforcement. Saying nothing while a claim spreads on social media damages trust whatever the facts turn out to be.
- Warn benefit recipients about fraud now. Whether or not the claim holds up, publicity about it will attract scammers posing as the agency. Tell residents, through clear official channels, that the agency will not ask for banking details or PINs by phone or text.
Sources: BYOD ransomware claims Texas health agency… HIFY Radar | Hospital Cyberattacks Bring Disruptions, Legal Fallout | Texas HHSC Ransomware Claim by BYOD (Nov 2026) | BYOD Claims Texas Health and Human Services Commission as New Ranso... | Vanderbilt Orders Campus Offline as Ransomware Gang ... | Security Crawler Carl: "Ransomware group BYOD is claim…" - Infosec... | Texas Health and Human Services Commission data breach notification... | 🏴☠️ Byod has just published a new victim : Texas HHSC