BYOD ransomware cartel claims breach of Texas Health and Human Services Commission

BreachNews reported that BYOD claimed on November 9, 2026 that it breached the Texas Health and Human Services Commission.

BYOD made a claim against Vanderbilt University on the same date. On November 9, 2026, Vanderbilt University reported a continuing cybersecurity incident that might affect university devices, systems and cloud services. Vanderbilt has not officially attributed the incident to the group or confirmed device encryption. It also has not disclosed the attack’s nature or confirmed whether data was stolen.

“Our Information Technology team is actively investigating and working to contain the situation,” Vanderbilt University said. BleepingComputer asked if systems were encrypted, what information might have been taken, and whether containment had been achieved.

Vanderbilt directed its students, faculty, and staff to turn off university devices and leave the university Wi-Fi network. Anyone who notices suspicious activity should not investigate or troubleshoot it alone, the university said. Vanderbilt also said people should power down devices and contact its IT service desk instead of handling the issue alone. The university told its community not to investigate on its own during the response.

The university listed unexpected pop-ups and security notifications as warning signs for its community during its active cybersecurity incident response. It also cited odd changes involving cloud files or permissions. Vanderbilt pointed to missing or modified files as another sign, along with unfamiliar apps and unexpected authentication requests. It shared these indicators with students, faculty, and staff.

BYOD started in 2026 and has posted five other organizations on its leak site. Last month the group said it attacked the University of New Mexico Health Sciences Center, causing system outages that disrupted patient care and academic activities. “the true flaw remained in your system,” BYOD said in its claim.

BYOD’s leak-site post claimed more than 1 million SSNs, names, email addresses, phone numbers, and student and employee records were taken from Vanderbilt.

A photograph shared with BleepingComputer shows an alleged computer screen with Vanderbilt icons and a ransom note called README_BYOD_31.txt, and BleepingComputer received it as evidence tied to the Vanderbilt incident. The ransom note includes a link to BYOD’s leak site. It also provides contact details for SESSION, an encrypted messaging platform. The note threatens to publish stolen data and cause more disruption unless negotiations happen.

BleepingComputer verified that the URL in the note goes to BYOD’s leak site. The outlet also received a video showing infected devices with audio warnings that the network is compromised by BYOD.