Texas Hunting & Fishing License Breach Exposes Data of 3 Million
A cyberattack on a third-party vendor handling hunting and fishing license sales for the Texas Parks and Wildlife Department (TPWD) has potentially exposed the personal information of over 3 million license holders. The breach, detected on June 18, 2026, was disclosed by state officials following an investigation led by Texas Cyber Command, the state’s cybersecurity agency established in 2025.
The compromised data includes driver’s license numbers, passport numbers (if provided), email addresses, phone numbers, and residential addresses. However, officials confirmed that Social Security numbers, dates of birth, financial information, and records belonging to minors were not accessed. The attack did not disrupt license sales, which will proceed as scheduled for the upcoming licensing year in August.
TPWD has implemented enhanced security measures, including additional safeguards, monitoring services, and stronger access controls, in collaboration with the vendor. To mitigate risks for affected individuals, the agency is offering one year of free credit monitoring through Kroll, with enrollment open until September 14, 2026.
The breach underscores the vulnerabilities posed by third-party vendors in government data systems. While no financial or highly sensitive personal data was exposed, the incident remains one of the largest reported data exposures in Texas this year due to the number of individuals impacted. Investigators continue to assess the full scope of the breach and whether the stolen data has been misused.
Source: https://sqmagazine.co.uk/texas-hunting-fishing-license-holders-data-breach/
Texas Parks and Wildlife Foundation cybersecurity rating report: https://www.rankiteo.com/company/texas-parks-and-wildlife-foundation
"id": "TEX1782132877",
"linkid": "texas-parks-and-wildlife-foundation",
"type": "Breach",
"date": "6/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '3,000,000',
'industry': 'Government/Public Sector',
'location': 'Texas, USA',
'name': 'Texas Parks and Wildlife Department (TPWD)',
'type': 'Government Agency'}],
'attack_vector': 'Third-party vendor compromise',
'customer_advisories': 'One year of free credit monitoring through Kroll '
'(enrollment open until September 14, 2026)',
'data_breach': {'number_of_records_exposed': '3,000,000',
'personally_identifiable_information': 'Driver’s license '
'numbers, passport '
'numbers, email '
'addresses, phone '
'numbers, residential '
'addresses',
'sensitivity_of_data': 'Moderate (driver’s license, passport '
'numbers, contact details)',
'type_of_data_compromised': 'Personal Identifiable '
'Information (PII)'},
'date_detected': '2026-06-18',
'description': 'A cyberattack on a third-party vendor handling hunting and '
'fishing license sales for the Texas Parks and Wildlife '
'Department (TPWD) has potentially exposed the personal '
'information of over 3 million license holders. The breach '
'includes driver’s license numbers, passport numbers (if '
'provided), email addresses, phone numbers, and residential '
'addresses. Social Security numbers, dates of birth, financial '
'information, and records belonging to minors were not '
'accessed.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'large-scale data exposure',
'data_compromised': 'Driver’s license numbers, passport numbers, '
'email addresses, phone numbers, residential '
'addresses',
'downtime': 'None (license sales proceeded as scheduled)',
'identity_theft_risk': 'Elevated due to exposure of personal '
'information',
'operational_impact': 'No disruption to license sales',
'payment_information_risk': 'None (financial information not '
'exposed)',
'systems_affected': 'Third-party vendor handling hunting and '
'fishing license sales'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Vulnerabilities posed by third-party vendors in '
'government data systems',
'post_incident_analysis': {'corrective_actions': 'Enhanced security measures, '
'monitoring services, '
'stronger access controls',
'root_causes': 'Third-party vendor compromise'},
'recommendations': 'Strengthen third-party vendor security assessments, '
'implement enhanced monitoring and access controls',
'references': [{'source': 'Texas Parks and Wildlife Department (TPWD)'}],
'response': {'communication_strategy': 'Public disclosure, credit monitoring '
'offer',
'containment_measures': 'Enhanced security measures, stronger '
'access controls',
'enhanced_monitoring': 'Yes',
'remediation_measures': 'Additional safeguards, monitoring '
'services',
'third_party_assistance': 'Texas Cyber Command'},
'title': 'Texas Hunting & Fishing License Breach Exposes Data of 3 Million',
'type': 'Data Breach'}