Oops.
A cyber attack has exposed the personal information of more than 3 million Texans.
Texas Parks and Wildlife said Saturday that a vendor that handles the sale of state hunting and fishing licenses was the victim of a data breach. An unauthorized user may have swiped personal driver license information, passport numbers, email addresses, phone numbers and residential addresses.
Texas Cyber Command detected the attack, which the parks department said did not compromise social security numbers, dates of birth or financial information. Lawmakers created the command unit in 2025 to combat cyber attacks.
The parks department said many of its own staff are hunters and fishers and were compromised by the attack.
“We recognize the seriousness of this issue and have identified and implemented additional security options to better protect customer information,” it said in a statement. “We are committed to continuing to work with the license system vendor to implement increased safeguards to prevent future incidents.”
Affected customers are eligible for one year of free credit monitoring through Kroll by calling 844-959-7123. The enrollment deadline is Sept. 14, 2026.
Here’s the TPWD press release on the incident, which unfortunately doesn’t have any more information about it. That’s unfortunate in part because there’s a key piece of information missing, namely how far back these stolen records go. I got a deer license eight or ten years ago, I don’t remember exactly how far back, prior to an outing with some family members. Am I affected by this breach or not? That will depend entirely on the data retention policies of the vendor that was the target of this attack. Do they regularly purge data that’s more than, say, five years old, or do they hoard it forever and thus ensure that any compromise they fall prey to is that much bigger? I have no idea, there’s nothing to say about it in the press release or the news coverage.
So let that be your tip of the day: when reporting on a cybersecurity incident that involves a data breach, define the scope of the breach by indicating how far back the data goes. And if you’re a company that holds onto people’s personal data, consider implementing a policy that states when and how often data that is no longer needed gets deleted. The people whose data may or may not be affected by future breaches would like to know.
WTF? People have to call a number to find out if they are affected? Lazy Republican officials at work! The state should be contacting victims, period.