Updated November 11, 2026: This profile covers BYOD’s emergence in September 2026, its leak-site claims against universities, a hospital system and a Texas state agency, the audio threats played on victim computers, and the gap between what victims have confirmed and what the group alleges.
First observed: Late September 2026.
Type: Financially motivated data-extortion and ransomware operation.
Attribution: Unknown. Security researchers have noted overlaps with the EndZone and UmBra extortion brands, but no shared ownership has been established.
Primary operations: Data theft, leak-site extortion, alleged device encryption and public pressure campaigns.
Targeting: Opportunistic, with a recent focus on U.S. higher education, healthcare and government, plus earlier telecom, retail, finance and hospitality claims.
Status: Active. The group posted new listings as recently as November 10, 2026.
BYOD went from an unknown name to one of the most disruptive new extortion brands of the fall in about 6 weeks. Ransomware trackers first linked its leak site to victim postings around September 29, 2026, and it carried nearly 20 listings by November 11. Most claims remain unverified, but several match publicly acknowledged incidents.
Its style is loud and personal. It taunts each victim, claims sweeping access to identity systems and tells organizations to contact it through a “contact tab” before it will “take you down.” At 2 large institutions, workers also heard spoken threats play on their own computers.
From telecom leaks to campus shutdowns
BYOD’s earliest public claims targeted consumer and business data rather than operations. In October, a threat actor attributed an alleged Trump Mobile breach affecting 3,615 customers to the group, claiming access came through malware on an employee device at a partner telecom provider. Trump Mobile has not confirmed that claim.
Early October listings also named a Malaysian pewter maker, a cryptocurrency exchange and a major U.S. wireless carrier. Security researchers said none of those cases showed confirmed file encryption.
That changed on October 26. A cyberattack on the University of New Mexico Health Sciences Center forced UNM Health to divert ambulances and cancel appointments at more than 30 clinics. BYOD listed UNM the same day and alleged it had compromised 36,000 machines across the main campus and hospital networks, along with Oracle databases and HR, payroll and student records.
An apology that kept the data
A day later, BYOD offered free decryption keys for locked devices on the hospital side only. The group said it had not known the machines supported patient care in real time, offered affected patients up to $2,500 each and said it would still keep the stolen data.
UNM rejected that framing. In its official update, the Health Sciences Center said it “did not make concessions with any group behind the threat” and that the event affected some end-user devices but “did not penetrate core systems or servers.” It warned people not to engage with anyone offering compensation and to report contact to the FBI’s Internet Crime Complaint Center.
Spoken threats on victim computers
The audio messages are BYOD’s most distinctive tactic. According to local reporting from KOB 4, an automated voice played on UNM hospital workstations, urging administrators to contact the attackers and claiming they held Social Security numbers, documents and emails. A red skull image reading “Oh no, you have been compromised” also appeared on employee screens.
The same playbook surfaced at Vanderbilt on November 9. The Vanderbilt Hustler reported that a professor’s university laptop showed about 40 “Read Me” documents and played a spoken message during class, and WSMV reported screens reading “You have been compromised by BYOD.” Our Vanderbilt coverage includes a student journalist’s video of one alleged audio threat.
The tactic turns a quiet intrusion into a public event, raising pressure on leadership before any negotiation starts.
Universities and a state agency in 10 days
The November run tilted toward large public institutions:
- November 1: BYOD listed Michigan State University, alleging it holds data on 1.03 million current and former students and staff. MSU tied the claim to an October credential event that led to a forced password reset and has not confirmed data theft.
- November 3: The group listed IHG Hotels & Resorts, alleging guest, loyalty, employee and financial data and mocking a weak directory password. IHG has not publicly confirmed an incident.
- November 9: Vanderbilt told everyone to shut down university devices and disconnect from Wi-Fi during an active cybersecurity incident. BYOD alleged it locked university databases and took more than 1 million Social Security numbers.
- November 9: BYOD claimed the Texas Health and Human Services Commission, alleging Medicaid, SNAP, TANF and banking data on 2 million Texans.
- November 10: New listings named Providence, with an alleged 25 GB of personal data and a claim that the group “did not lock your network, yet,” and Toyota, with alleged customer data and kiosk device access. Neither company has publicly confirmed an incident.
Vanderbilt said in its November 10 evening update that it is working with government agencies, is still determining “what data, if any, may have been accessed” and that full restoration may take multiple weeks. It has not named BYOD or confirmed ransomware.
HHSC said in a statement to reporters that it is aware of claims alleging unauthorized access to agency data and is working with the Texas Cyber Command and federal partners to assess them. The agency said the claims “remain unverified at this time.”
Identity systems sit at the center of its claims
No security vendor or government agency has published a full technical analysis of BYOD’s tooling, and BreachNews found no CISA or FBI advisory specific to the group as of November 11.
Those sources point to access built on stolen credentials rather than custom exploits. Researchers have tied infostealer-harvested logins to several claimed victim domains, and BYOD itself has claimed it entered through a partner’s employee and found no multifactor authentication. MSU’s response, a campus-wide password reset after suspicious activity aimed at login information, fits the same theme.
Once inside, BYOD consistently claims control of identity infrastructure. It alleged “full takeover” of Vanderbilt’s domain controller, compromise of UNM’s Active Directory forests and Microsoft Entra tenant, and IHG’s directory and password vault. These claims are unverified, and UNM said core systems were not penetrated.
Leak-site listings end with nearly identical language inviting contact and promising to remove the post once talks begin.
Links to EndZone and UmBra remain loose
Security researchers have reported that BYOD re-posted at least 2 victims first claimed weeks earlier by a group called EndZone, including the Trump Mobile data. A BYOD representative reportedly denied any formal affiliation but said a member knows people behind EndZone.
Separately, one security vendor’s tracker notes that BYOD’s leak site looks like the UmBra group’s site and that both launched around the same time. Shared templates and overlapping claims point to a loosely connected cluster, not proof of a rebrand.
Defensive priorities for schools and agencies
- Require phishing-resistant multifactor authentication on all remote, partner and administrator accounts, and treat any credential found in infostealer logs as compromised.
- Monitor domain controllers, Entra ID and privileged access tools for new admin accounts, policy changes and unusual sign-ins.
- Plan for data-only extortion as well as encryption, with tested offline backups.
- Prepare communications for staff and students on what to do if a device displays or speaks a threat, and tell them never to contact the attackers.
All BYOD coverage from BreachNews
- BYOD claims Texas HHSC breach affecting 2 million residents.
- Vanderbilt tells campus to shut down devices as BYOD claims attack.
- Michigan State University claimed by BYOD after NetID password reset.
- UNM Health cyberattack diverts ambulances and cancels appointments.
- Trump Mobile allegedly breached, with the claim attributed to BYOD.
For other recent ransomware activity in education, see the Burnaby School District attack claimed by Qilin and our Qilin threat actor profile.
Threat assessment
BYOD is new, fast and willing to hit institutions where disruption is felt immediately. Its record counts are unproven, but the outages at UNM and Vanderbilt were real. Defenders should treat the group as an active threat to education, healthcare and public agencies while weighing each claim against victim disclosures and technical evidence.
Changelog
November 11, 2026: Initial profile with BYOD’s emergence, major claims, audio threat tactic, reported EndZone and UmBra links and all BreachNews coverage.
