Texas says vendor breach may have exposed data of more than 3 million license customers
Texas Parks and Wildlife Department said a vendor-linked cybersecurity incident may have exposed personal information for more than 3 million hunting and fishing license customers, but not Social Security numbers, dates of birth or financial data.
Texas Parks and Wildlife Department said a cybersecurity incident involving its license-system vendor may have exposed personal information for more than 3 million hunting and fishing license customers.
Texas Parks and Wildlife Department said a cybersecurity incident involving a vendor that handles hunting and fishing license sales may have affected more than 3 million Texas customers, according to a Security Magazine report published June 26, 2026.
The department said the incident may have exposed driver license information, passport numbers, email addresses, phone numbers and residential addresses. It said Social Security numbers, dates of birth and financial information, including credit card details, were not obtained.
Security Magazine cited comments from outside security leaders who said exposed identity documents can be used to identify customers and, in some cases, support account takeover or phishing attempts.
According to the report, Texas Cyber Command detected the incident involving TPWD’s license-system vendor. The vendor handles the sale of hunting and fishing licenses. TPWD said there was no evidence that customers under 18 were involved or that any specific group was targeted.
Security Magazine also quoted Jake Williams, described in the article as a former NSA hacker and faculty at IANS Research, saying outsourcing state and local IT systems is common because it is often cheaper than building and maintaining them in-house. He said legacy compatibility issues can force security downgrades and warned that similar state wildlife licensing platforms could be targeted.
The article also quoted Kevin Gosschalk, founder and CEO of Arkose Labs, who said exposed driver’s license and passport data can enable account takeover, synthetic identity fraud and targeted phishing at scale. He said organizations should assume the data is already in circulation and act accordingly.
Security Magazine identified Rachelle Blair-Frasier as its editor in chief. The report did not add new breach facts beyond TPWD’s notification and the quoted security commentary.
What happens next was not detailed in the report. TPWD’s notification and any follow-up by the vendor or Texas officials were the only next steps described in the source material.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()