The BYOD ransomware gang posted a claim on its leak site that it attacked Vanderbilt University in Tennessee. According to the claim, the group encrypted databases and stole student, employee and research data. According to reports, the university confirmed a cyber incident but did not publish details about the nature of the attack or confirm whether data was stolen.
At the same time, the same group claims it stole records on about 2 million residents from the Texas Health and Human Services Commission (HHSC), the body that runs, among other things, the state's medical insurance and public assistance programs. That is the attackers' claim alone, and no official confirmation has been published so far. Ransomware gangs tend to exaggerate how much data they hold to raise pressure, but they also tend to publish the data when the victim does not pay.
BYOD is not a new name. Last month the group claimed it stole personal data on 1.3 million current and former students from Michigan State University. Its choice of targets reveals the method: universities and public bodies hold huge amounts of personal data, old and fragmented systems and limited security budgets. They also struggle to keep services down for long, and that is exactly the leverage gangs look for.
The risk to victims does not end with paying or not paying. Data on students and patients, including ID numbers, insurance details and medical history, is raw material for identity theft and fraud for years. And someone whose data leaked from a government agency cannot simply 'change' it like a password.
In Israel too, universities, hospitals and health funds have been targets of such attacks in recent years. The lesson from the current wave is simple and uncomfortable: institutions holding sensitive data on millions of people need to treat security as critical infrastructure, not as a line item to cut when budgets are tight.
