The BYOD ransomware gang claims it has breached the Texas Health and Human Services Commission (HHSC) and is holding data on about 2 million Texans. The group added the state agency to its leak site on Monday, November 9, 2026, alleging the stolen records cover Medicaid, SNAP, TANF and disaster assistance programs, along with banking information.
HHSC had not issued any public statement about the claim at time of publication. The gang has not posted data samples, file listings or a data size, and BreachNews has not been able to verify any part of the claim.
What BYOD says it took from HHSC
According to security researchers who track leak sites, the post is short and offers no proof. BYOD alleges that “the whole program” was compromised and lists 2 million Texas citizens, Medicaid, banking information, SNAP, TANF and disaster assistance as the data involved. It does not say when or how the gang got in, and it does not mention encrypted systems.
The group also told the agency to reach out through a contact tab on its site and threatened to “take you down” once talks begin. That pressure tactic is typical of double extortion, where a gang steals data and then threatens to leak it unless a ransom is paid.
A claim of 2 million people should be treated with caution until HHSC or other evidence backs it up. Ransomware groups often inflate record counts, recycle old data or overstate access to push victims into paying.
A taunt about HHSC’s earlier insider breach
The post opens by mocking HHSC over a breach the agency has already disclosed. BYOD claims that firing employees “for leaking ~94k records” did not fix the problem and that “the true flaw remained in your system.”
That earlier incident was not a hack. On January 17, 2025, HHSC said agency employees had improperly accessed the account and personal information of at least 61,000 people. The agency fired the employees involved and referred the case to the Texas Health and Human Services Office of Inspector General to pursue criminal charges.
On April 30, 2025, HHSC notified another 33,529 people, bringing the total to at least 94,000. By then nine employees had been fired. The agency said the improper access ran from June 2021 to January 2025 and could have included names, addresses, dates of birth, Social Security numbers, Medicaid and Medicare ID numbers, and banking, benefits and medical information. Its substitute notice and FAQ says affected people were offered two years of free credit monitoring.
There is no public evidence linking BYOD’s new claim to that insider case.
No filing or notice yet
As of the afternoon of November 10, the HHSC newsroom had no statement about a cyberattack or data breach. The Texas Attorney General’s data breach report list also showed no new HHSC filing.
A busy fall for BYOD
BYOD is a newer group that has stepped up its activity this fall. It claimed Vanderbilt University the same day as HHSC, after the university told staff and students to shut down their devices during an active cybersecurity incident. Earlier it listed Michigan State University and the University of New Mexico Health Sciences Center, which suffered a cyberattack that diverted ambulances in October. The group was also named in an alleged Trump Mobile customer data leak.
What Texas benefit recipients can do now
- Check Lone Star Card activity at YourTexasBenefits.com or in the Your Texas Benefits app, and report any SNAP fraud by calling 2-1-1 and choosing option 3.
- Watch bank statements and Medicaid explanation of benefits notices for activity you do not recognize.
- Be wary of calls, texts or emails about your benefits that ask for personal or banking details.
- Consider a free credit freeze with Equifax, Experian and TransUnion.
This article reflects information available at the time of publication and will be updated if HHSC responds or the claim is confirmed.
