Two Million Texans. One Unproven Claim.
A ransomware gang says it stole the personal records of about two million Texans from the state agency that runs Medicaid, food assistance, and disaster aid. The gang has shown no proof. The agency has said nothing. And the claim is still worth taking seriously — because of who is making it, and what they say they took.
The gang calls itself BYOD. Its listing appeared on the group’s dark-web leak site on November 9, naming the Texas Health and Human Services Commission — the agency that serves more than 7.5 million Texans a month. According to the gang, a flaw in the agency’s systems let it in, and the haul includes Medicaid records, SNAP food-assistance records, TANF cash-assistance records, disaster-aid records, and banking information.
That is a big claim. It is also, so far, only a claim.
The proof is missing
Three things would normally turn a listing into a confirmed breach: samples of the stolen data, a working leak site, and a statement from the victim. This story has none of them. The gang has released no data samples. The leak site was down when reporters checked it. And the Health and Human Services Commission has not confirmed an incident, or commented at all. Cybernews, which first reported the claim, says it has reached out to the agency and is waiting for a response.
Ransomware gangs exaggerate: a listing is an advertisement, not evidence, and some gangs list victims they never breached. Until samples appear or the agency confirms something, two million is a number the gang chose, not a number anyone has verified.
Why the claim still matters
Unproven is not the same as harmless. Benefit records tie a name to a Medicaid case, a food-assistance account, and a bank account at the same time. Cybernews’s research team warns that data like that could open credit accounts, apply for loans, file fraudulent tax returns, take over bank accounts, commit SNAP and EBT fraud, or run scams so personalized the victim has no reason to doubt them.
Two million people would make this one of the largest benefit-data exposures in the country — and the agency serves more than 7.5 million Texans a month, so the claimed haul would be a fraction of what its systems hold. That is the part that should worry state agencies everywhere: the systems that pay out benefits also hold the richest identity data in government.
Meet the gang making the claim
BYOD is new — it first surfaced in September — but it has been busy. Its first public outing was the Trump Mobile breach, where it published data belonging to 3,615 users. Then it hit the University of New Mexico Health Sciences Center, claiming 36,000 machines including the Active Directory systems behind the campus and hospital networks. Ambulances were diverted and surgeries canceled; when the gang realized it had hit machines supporting live patient care, it apologized and offered a free decryptor.
The Texas listing appeared the same day as another BYOD claim: Vanderbilt University, where the gang says it encrypted databases and stole data on more than a million people. Vanderbilt has not confirmed that either. Two big listings in one day from a two-month-old gang is either a gang on a run — or a gang inflating its reputation.
The agency has been here before
If the claim proves true, it will not be the first time the commission’s client data has been exposed. In January 2025, the agency disclosed that employees had illegally accessed the records of more than 61,000 Medicaid, CHIP, TANF, and SNAP recipients between June 2021 and December 2024. That was an insider problem, not a ransomware gang, and there is no sign the two are connected — but it shows the agency’s systems have been a soft target before.
Government benefit systems keep getting hit for the same reason: they hold complete identity files on millions of people who cannot choose another provider. An aid agency’s portal exposed 20,614 users earlier this month, and the pattern is identical — a single system, years of records, and victims who find out from the news.
What Texans should do
Watch your benefit accounts. If you receive Medicaid, SNAP, or TANF in Texas, check your benefit balance and history for anything you do not recognize, and report it.
Freeze your credit. A credit freeze is free, takes minutes with each bureau, and blocks anyone from opening accounts in your name — including someone holding your benefit and banking details.
Ignore unsolicited “benefit” messages. The data the gang claims to hold is exactly what a scammer needs to sound legitimate: your name, your program, your case details. Any message about your benefits that asks you to click, call, or “verify” should be treated as a scam until you confirm it through the agency’s own channels.
Do not watch the leak site. If samples appear, they will be reported. Until then, act as if your data could be out there — without assuming it is.
Two million Texans is a headline. Whether it is a fact is still open — and the answer will come from evidence, not from a listing on a gang’s website.