A ransomware group known as BYOD claims to have stolen sensitive personal information belonging to approximately two million Texas residents after allegedly compromising a state government agency responsible for healthcare and public assistance programs. The allegations have not been independently verified, and the agency has not publicly confirmed a new data breach.
The suspected target is the Texas Health and Human Services Commission (HHSC), which administers programs providing medical coverage, food assistance, and financial support to millions of residents. The agency serves more than 7.5 million people each month, making its systems a potentially valuable target for cybercriminals.
BYOD announced the alleged intrusion on its dark web leak site, claiming that a security vulnerability allowed its members to gain unauthorized access to the agency’s infrastructure. The group says it obtained records connected to Medicaid, the Supplemental Nutrition Assistance Program (SNAP), Temporary Assistance for Needy Families (TANF), and disaster assistance services.
The attackers also claim to possess banking information associated with program recipients. However, they have not released publicly verifiable samples demonstrating that the records were stolen or establishing how many individuals may be affected.
At the time of reporting, the group’s leak website was unavailable. Researchers were therefore unable to examine the alleged database or confirm whether the advertised information was authentic.
If the claims prove accurate, the exposed records could create substantial risks for affected residents. Information about healthcare coverage, government benefits, and financial accounts could potentially support identity theft, fraudulent loan applications, unauthorized banking activity, and scams targeting assistance recipients.
The alleged incident follows an earlier confirmed breach involving HHSC. In January 2025, the agency disclosed that employees had improperly accessed personal information belonging to more than 61,000 recipients of Medicaid, the Children’s Health Insurance Program, TANF, and SNAP.
That investigation identified unauthorized employee activity occurring between June 2021 and December 2024. There is currently no evidence connecting the previous incident to BYOD’s latest allegations.
BYOD is a relatively new ransomware operation that emerged in September 2026. The group has recently claimed responsibility for several attacks against organizations in the United States, including telecommunications and healthcare-related targets.
In October, the gang published information allegedly belonging to 3,615 Trump Mobile customers. The exposed records reportedly included names, email addresses, telephone numbers, residential addresses, and order information.
The group has also claimed an intrusion into the University of New Mexico Health Sciences Center, where a cybersecurity incident disrupted medical operations. BYOD later reportedly offered a free decryption tool after learning that compromised systems supported active patient care.
These previous activities provide context for the group’s claims but do not establish that it successfully compromised the Texas government agency.