Texas Health and Human Services Commission · Breach

[Single source] BYOD ransomware claims Texas health agency data of 2 million

Nov 09, 2026 · 1 min read

BYOD ransomware claims it breached the Texas Health and Human Services Commission, the state agency overseeing Medicaid and other public assistance programs. The group alleges data tied to about 2 million Texas residents was accessed, beyond a previously reported leak of roughly 94,000 records. The claim has not been confirmed by the agency.

By HIFY Radar newsroom Updated 11/09/2026 01:46 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Alleged

The BYOD ransomware group claims to have compromised the Texas Health and Human Services Commission, alleging that data tied to approximately 2 million Texas residents was accessed: a significant escalation beyond a previously reported leak of roughly 94,000 records.

Alleged

The same group also claims it locked Vanderbilt University's databases and accessed its broader IT and research environment, allegedly including more than 1 million Social Security numbers along with names, email addresses, phone numbers, and student and employee records. Both claims remain unverified.

What happened

Observed

According to a post from the threat-intelligence account DarkWebInformer, the BYOD ransomware group publicly claimed two major U.S. organizations as victims: the Texas Health and Human Services Commission and Vanderbilt University.

Alleged

BYOD allegedly stated that the compromise of the Texas Health and Human Services Commission: the state agency overseeing Medicaid and other public assistance programs: extends well beyond a previously reported leak of roughly 94,000 records, claiming data tied to approximately 2 million Texas residents was accessed.

Alleged

Regarding Vanderbilt University, a private research university in Nashville, Tennessee, the group claims its databases were locked and alleges access to the institution's broader IT and research environment, including more than 1 million Social Security numbers, names, email addresses, phone numbers, and student and employee records. The claim is currently unverified.

Why it matters

Inferred

If accurate, the claimed scale: roughly 2 million Texas residents whose data may have been accessed through the state's health and human services agency: would make this one of the larger state government data exposures, affecting people enrolled in Medicaid and other public assistance programs who often cannot opt out of data collection.

Inferred

The Vanderbilt claim, involving more than 1 million Social Security numbers plus student and employee records, raises concerns about identity theft and the security of academic, medical, and research environments if the alleged access to the broader IT infrastructure is confirmed.

What to do

Inferred

Until the claims are verified, Texas residents who interact with Health and Human Services Commission programs and Vanderbilt students and staff should be alert for phishing attempts referencing the incident, monitor financial and credit activity, and consider credit monitoring given the alleged involvement of Social Security numbers.

Inferred

Affected organizations and observers should await official statements from the Texas Health and Human Services Commission and Vanderbilt University before treating the claimed data volumes as confirmed, since ransomware groups routinely exaggerate the scale of breaches for leverage.

Confirmed and still uncertain

Observed

Known: a post by DarkWebInformer reports that BYOD named the Texas Health and Human Services Commission and Vanderbilt University as victims, and that a leak of roughly 94,000 Texas records was previously reported.

Contested

Unknown: whether BYOD actually accessed data of approximately 2 million Texas residents, whether Vanderbilt's databases were locked, whether more than 1 million Social Security numbers were obtained, and whether sample or leaked data has been published. The claim is currently unverified, and no official confirmation from either organization is present in the evidence.

What people are saying

Observed

DarkWebInformer, the threat-intelligence account that surfaced the claims, framed the post as alleging large-scale exposure of government, healthcare, university, and research data, and explicitly cautioned that the claim is currently unverified.

Inferred

No statements from the Texas Health and Human Services Commission, Vanderbilt University, or other observers are present in the current evidence batch.

Evolution

Alleged

The reported scope of the Texas incident has grown substantially: an earlier leak involved roughly 94,000 records, and BYOD now claims the compromise extends to data tied to approximately 2 million Texas residents.

Observed

The disclosure also broadens BYOD's claimed footprint across sectors, naming both a state government health agency and a private research university in a single announcement.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

BYOD's claims imply a double-extortion-style operation: at Vanderbilt, the group claims to have locked databases while also alleging it obtained copies of sensitive data, including Social Security numbers and contact records.

Inferred

No technical indicators: initial access method, malware samples, command-and-control infrastructure, or published leak-site evidence: are included in the current reporting.

Sources and evidence

Observed

This brief is based on a single source: a post from the account DarkWebInformer on X (published around November 2026) that aggregates BYOD ransomware claims against the Texas Health and Human Services Commission and Vanderbilt University.

Contested

The source itself labels the claims unverified and provides no direct evidence such as leaked data samples, screenshots from the ransomware group's infrastructure, or official confirmations. All victim and volume figures should be treated as allegations pending corroboration.