Ransomware gang claims records of 2 million Texans from state health agency
The BYOD ransomware gang, which hit Vanderbilt on Monday, listed the Texas Health and Human Services Commission on its leak site on November 9, claiming it stole records belonging to about two million Texans. The claim is unverified: no data samples have been released and the agency has not confirmed an incident.
📊 Scorecard: our Bearish call on $CRWD is scored from $225.76, the last close before it ran. Its first result comes after the next close.
The News
The BYOD ransomware gang, which hit Vanderbilt University on Monday, also listed the Texas Health and Human Services Commission (HHSC) on its leak site on November 9, claiming it stole records belonging to about two million Texans. The claimed haul includes Medicaid, SNAP and TANF records — the benefit programmes that pay for health care, food and cash assistance for people on low incomes — plus disaster-assistance records and banking records. HHSC serves more than 7.5 million people a month, making it one of the largest state agencies in the country.
The claim is unverified, and that matters as much as the number itself. The gang has released no data samples, its leak site was down when checked, and HHSC has not publicly confirmed an incident. Until the agency or an independent source confirms it, the figure of about two million people is the gang's claim only — not an established fact. Ransomware gangs have an incentive to exaggerate: a bigger claimed haul means more pressure on the victim to pay.
BYOD is a new gang. It first surfaced in September 2026 and previously published data on 3,615 Trump Mobile users — a much smaller haul than the one it is now claiming. The Vanderbilt attack on Monday was its most high-profile hit so far, and the Texas listing appeared the same day. Yesterday's AI Agent Update story on Vanderbilt mentioned the HHSC listing only in passing; this is the first full reporting of the claim and its scale.
A ransomware gang claims records for two million Texans — but with no samples shown and no confirmation from the agency, the number is a claim, not a fact.
Why It Matters
The scale is the first thing to grasp. If the gang's claim is true, about two million people — roughly one in fifteen Texans — would have had records taken from an agency that serves more than 7.5 million people a month. The data types make it worse: Medicaid and SNAP records carry health and financial details, and banking records can be used directly for fraud. That combination is why state health agencies are such attractive targets.
The second thing is the speed. BYOD first surfaced in September 2026, and its previous known haul was data on 3,615 Trump Mobile users. In a single day it went from hitting Vanderbilt to claiming a state agency serving millions. Whether or not the Texas claim proves true, the gang is moving fast and aiming high, and other state agencies will be watching closely.
The read-through for security vendors is straightforward: every high-profile ransomware claim against a government agency supports spending on the tools that prevent and detect these attacks. CrowdStrike and Palo Alto Networks are the public read-through tickers here — HHSC is a state agency with no ticker of its own. CrowdStrike closed Tuesday at $225.76, down 1.23%, and Palo Alto Networks at $326.36, down 1.37%, on a down day for the market rather than on this news.
Analyst's Take
Our call is Bearish. The event itself is a claimed breach of a major state agency holding health and benefit records for millions of people — the kind of attack that, if confirmed, would be one of the largest state-government data incidents of the year. Even as an unverified claim, it shows a new ransomware gang moving quickly from a university to a state agency in a single day, and the data types it claims to hold — Medicaid, SNAP, banking — are exactly the records that cause the most harm when they leak.
What to watch: whether HHSC confirms or denies an incident, whether the gang releases data samples, and whether its leak site comes back online. If the claim is confirmed, the scale — about two million people — would put it among the biggest breaches of 2026. If it is not, it will still stand as a warning about how fast a new gang can claim a high-profile victim.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is the BYOD ransomware gang?
BYOD is a ransomware group that first surfaced in September 2026. Ransomware gangs break into an organisation's systems, steal data, and threaten to publish it unless they are paid. BYOD previously published data on 3,615 Trump Mobile users.
What is a leak site?
A leak site is a website run by a ransomware gang where it names its victims and posts stolen data to pressure them into paying. The gang lists the Texas Health and Human Services Commission on its leak site — but the site was down when checked, and no stolen data has been shown publicly.
What are Medicaid, SNAP and TANF?
They are US government benefit programmes. Medicaid pays for health care for people on low incomes, SNAP (food stamps) helps people buy food, and TANF gives cash assistance to families with children. The gang claims the stolen records include data from these programmes, plus disaster-assistance and banking records.
Why is the two-million figure unverified?
Because it comes only from the gang itself. It has released no data samples, its leak site was down when checked, and the Texas Health and Human Services Commission has not publicly confirmed any incident. Until the agency or an independent source confirms it, the number is a claim, not a fact.
What is the connection to the Vanderbilt attack?
BYOD hit Vanderbilt University on Monday, November 9. The same gang listed the Texas health agency on its leak site the same day. Yesterday's AI Agent Update story on Vanderbilt mentioned the Texas listing only in passing; this is the first full reporting of the claim and its scale.
👁
Source: Cybernews