Texas Parks & Wildlife Department License System Data Breach Affects Over 3 Million Texans

Texas Cyber Command identified a breach of the third-party vendor that processes hunting and fishing license sales for the Texas Parks and Wildlife Department (TPWD). The unauthorized actor accessed driver’s-license numbers, passport numbers (when supplied), email addresses, phone numbers and residential addresses. TPWD was notified on May 13 and publicly disclosed the incident in early June. The vendor’s systems store the personal data of all license holders, and the breach occurred before the notification, though the exact date remains unknown.

KTRK - ABC13 - HoustonThe Register UKNotification of Data Security Incident — Texas Parks & Wildlife Department

A filing with the Office of the Attorney General lists 3,087,721 Texans as affected. Exposed records include driver’s-license information, passport numbers, email addresses, phone numbers and residential addresses. TPWD states that Social Security numbers, dates of birth and credit-card details were not obtained. No evidence shows customers under 18 were impacted.

KTRK - ABC13 - Houston

TPWD described the breach as serious and said it has added security options and enhanced monitoring for customer profiles. The department noted that many staff members, who are hunters and anglers, were also affected. TPWD is working with the vendor to tighten access controls and will continue scheduled license sales in August. Affected customers may receive one year of free credit-monitoring from Kroll if they enroll by September 14, 2026, via a dedicated call center (844-959-7123).

Notification of Data Security Incident — Texas Parks & Wildlife Department

The Attorney General’s filing contradicts TPWD’s statement by indicating that individuals’ names and Social Security numbers were also compromised, raising questions about the completeness of the department’s disclosure and the vendor’s security practices. Investigators have not determined when the attackers accessed the data, and the precise breach date remains unknown, limiting a full assessment of the incident’s scope.

KTRK - ABC13 - Houston

• “We recognize the seriousness of this issue and have identified and implemented additional security options to better protect customer information.” — Texas Parks & Wildlife Department spokesperson

Notification of Data Security Incident — Texas Parks & Wildlife Department

• “Many of our staff are hunters and anglers and were affected by this incident. We are committed to continuing to work with the license system vendor to implement increased safeguards to prevent future incidents.” — Texas Parks & Wildlife Department spokesperson

The Register UK

• “Social Security numbers, dates of birth and financial information, including credit card details were not obtained from this incident.” — TPWD statement

Notification of Data Security Incident — Texas Parks & Wildlife Department

• “The filing appears to contradict the department's disclosure, noting that individuals' names and SSNs were also involved.” — The Register article

The Register UK

License sales for August will proceed despite a brief vendor-website outage. Customers must enroll in Kroll credit-monitoring by September 14 to receive protection. TPWD and Texas Cyber Command continue investigating the breach and evaluating further safeguards.

The Register UK