Personal data belonging to more than three million Texas hunting and fishing license customers has been potentially exposed due to a cybersecurity incident affecting a vendor for the Texas Parks and Wildlife Department (TPWD). The breach, detected by Texas Cyber Command, may have allowed an unauthorized actor to obtain sensitive information from customer profiles.
While Social Security numbers, dates of birth, and financial details including credit card information were not compromised, the exposed data could include driver's license information, passport numbers (if provided), email addresses, phone numbers, and residential addresses. TPWD stated that there is no evidence that customers under 18 were involved or that any specific group was targeted.
The compromised information, however, can still provide scammers with sufficient details to craft convincing fraudulent communications. Access to a customer's name, phone number, home address, and license-related details can enable impersonation of state agencies or vendors, potentially leading to phishing attempts or requests to "verify" identity.
In response to the incident, TPWD has implemented immediate measures to strengthen access controls for customer profile data and is collaborating with its license system vendor to enhance safeguards and monitoring. The agency has assured that license sales will continue on schedule and believes current and future customer data are not at risk.
Affected customers are advised to monitor their accounts for suspicious activity. TPWD is offering one year of free credit monitoring to eligible customers who call a dedicated response line at 844-959-7123. The enrollment deadline for this service is September 14, 2026.
To further protect themselves, individuals are encouraged to consider signing up for credit monitoring or identity theft protection, freezing their credit with the three major credit bureaus (Equifax, Experian, and TransUnion), and placing a fraud alert on their credit files. It is also recommended to remove personal information from people-search websites, watch for potential misuse of driver's license or passport information, and be wary of unsolicited communications claiming to be from TPWD or related services. Using strong antivirus software, avoiding sharing verification codes, checking financial accounts regularly, and employing strong passwords with two-factor authentication are also advised steps.