-
A ransomware group called Byod claims it took information on about 2 million Texas residents from the state’s Health and Human Services Commission (HHSC).
-
The alleged data covers Medicaid, SNAP, TANF, disaster assistance details, and banking information.
-
Texas authorities have not confirmed the new claim, and the group has not shared any data samples as proof.
Ransomware groups are criminal gangs that attack computer systems. One of them, called Byod, says it broke into the Texas Health and Human Services Commission (HHSC). The group claims it took private details of about 2 million Texas residents. Byod posted the claim online and named HHSC as its target. The post appeared on the group’s leak site, a page where ransomware groups list their alleged victims.
Texas authorities have not confirmed the claim. The group has not shown any data samples to support its words. Right now, the story rests on the group’s own statement. This report covers what Byod claims and what officials have confirmed so far.
Byod Lists the Texas Health Agency as a Victim
Byod published the claim on its leak site on November 9, 2026. The post lists HHSC as an alleged victim. HHSC is a Texas state agency, and the listing names it directly. According to the post, the data covers several public assistance programs.
These programs include Medicaid and the Supplemental Nutrition Assistance Program (SNAP). They also include Temporary Assistance for Needy Families (TANF). Disaster assistance details appear on the list as well. All of these programs support Texans who need health or financial help.
Byod also says the data contains banking information. However, the group has not given the public any samples to check. It has not shared other proof that shows it holds the records.
A cybersecurity intelligence platform recorded the same listing on November 9. It also copied the group’s statement, so readers can see what Byod wrote. Its report confirms that Byod made the claim. The report does not confirm that the data theft actually happened.
As of November 10, the sources reviewed show no official confirmation from Texas HHSC. So the claimed figure of two million affected residents is unverified. The alleged exposure of their information is also unverified.
Byod Points to an Earlier HHSC Privacy Incident
In its statement, Byod referred to an older privacy incident at the agency. The group asked why HHSC had not dealt with what it called a deeper security weakness.
That older case involved HHSC employees who improperly accessed sensitive information. BYOD used it to question the agency’s security. HHSC announced it on January 17, 2025. The agency said at least 61,000 people might have had their information accessed this way. Agency staff were the ones who accessed it. HHSC said it fired the employees involved. It also referred the matter to its Office of Inspector General for investigation.
On April 30, 2025, HHSC shared an update. The agency said its investigation had found more affected people. The total rose to at least 94,000. HHSC also confirmed that it had fired nine employees over the incident.
The earlier investigation involved personal, financial, banking, health, and benefits information. HHSC said the possibly affected records related to improper access between June 2021 and January 2025. That period lasts more than three years. Both announcements are public notices on the agency’s own website.
The two cases differ in one key way. The 2025 incident involved misconduct by employees. HHSC handled it through firings and an inspector general referral. Byod’s latest statement describes a separate break into the agency’s systems. No verified evidence links the two incidents. Nothing shows that the ransomware group reached the records exposed earlier.
Possible Fraud Risks Remain Unproven as Listings Spread
If Byod’s claims prove true, the incident could worry many Texans. These residents rely on government health and financial assistance programs. Banking information could raise the risk of financial fraud. Personal and benefits records could give criminals what they need for identity theft and targeted scams.
Similar concerns have emerged in another US breach claim, involving telecom brand Trump Mobile and an alleged exposure affecting 3,615 users, as covered in detail in our report on the Trump Mobile data breach claim.
However, these risks are only possible outcomes, not confirmed ones. The available information leaves several questions open. It does not show which systems the group reached. It does not explain how the break-in happened or when it may have taken place. It also does not prove that Byod holds the information it claims to have stolen.
The new listing has appeared on several cybersecurity monitoring platforms. According to one report, the claim was logged against HHSC and the group Byod. Another report repeats the figure of two million residents. These reports mostly record the same claim from the same threat actor. They all point to the same date, November 9. They do not offer independent proof of a successful attack.
For now, the incident remains an unverified ransomware allegation. Three things would help settle the matter. Texas HHSC could confirm the incident. Byod could provide supporting evidence. Officials could also send notices to affected residents. Any of these steps would help show the real size and impact of the alleged breach.
