The ransomware group known as BYOD has claimed it compromised the Texas Health and Human Services Commission (HHSC), the state agency that runs Medicaid, food assistance and other benefit programmes, and says it holds sensitive data on 2 million Texas citizens. The claim appeared on the group's leak site on 9 November 2026 and was first tracked by the Ransomware.live platform the same day.

The agency has not publicly confirmed an incident and did not immediately respond to questions from reporters. The claim therefore remains unverified by the victim, and the figures cited below are the group's own claims, not confirmed facts.

What the group claims to have taken

According to the leak-site listing, the stolen material includes records relating to Medicaid, banking information, the Supplemental Nutrition Assistance Program (SNAP), Temporary Assistance for Needy Families (TANF) and disaster assistance. The group says it has compromised the "whole program" and taunted the agency over an earlier incident involving about 94,000 records, claiming that the underlying flaw was never properly fixed.

The group has indicated it intends to extort the agency, saying it will "take you down" once communication is established. As of 10 November, the listing remained active on the Ransomware.live tracker, which records the discovery date as 9 November and the estimated attack date as the same day.

BYOD's recent run of claims

BYOD is a relatively new ransomware operation that emerged in 2026 and runs a data-leak site listing victims whose data it claims to have stolen. The group claimed responsibility on Monday 9 November for a cyberattack on Vanderbilt University in Nashville, saying it had encrypted the university's databases and stolen more than 1 million Social Security numbers along with student and employee records. Vanderbilt confirmed it was dealing with an active cybersecurity incident but has not confirmed the group's claims about the extent of its access or the data allegedly taken.

The group has previously claimed attacks on the University of New Mexico Health Sciences Center, where an attack in October disrupted patient care and academic work, on Michigan State University, and on Trump Mobile's customer database. The pattern of claims against universities, health services and now a state benefits agency suggests the group is deliberately targeting organisations that hold large volumes of personal data.

What Texans should watch for

If the claim proves accurate, the exposure of banking details alongside benefit records would create a serious risk of identity theft and financial fraud for people who receive Texas state benefits. Threat intelligence analysts advising on the incident say anyone who receives Medicaid, SNAP, TANF or disaster assistance in Texas should monitor their financial accounts closely and consider placing a fraud alert on their credit reports.

Security advisers also say the case underlines a wider lesson for public-sector organisations: after a security incident, the underlying vulnerability must be fully removed, not just the immediate symptoms. The group's claim that a "true flaw" remained in HHSC systems after an earlier incident, if true, would be a warning to any organisation that has recently remediated a breach to check that the root cause is genuinely closed.

HHSC has not yet issued a public statement. This report will be updated if the agency confirms or denies the incident.

Sources: QPulse Intelligence and The Register.