A cyberattack on a contractor that sells hunting and fishing licenses for the Texas Parks and Wildlife Department (TPWD) exposed the personal information of 3,087,721 customers to potential theft.
TPWD said the incident was detected by the Texas Cyber Command and that an unauthorized actor may have accessed data in customer profiles. The agency did not name the contractor but said it has tightened access controls to customer profile data and plans additional security measures.
Leaked data
According to TPWD's statement, information that may have been leaked includes driver's license information, passport numbers if applicable, email addresses, phone numbers, and home addresses. It stated that Social Security numbers, dates of birth, and financial information, including credit card details, were not compromised.
This combination of data could allow scammers to send convincing fake messages by posing as an official agency or bank. Experts warn that such information can be used for identity theft and fraud attempts.
TPWD's response
TPWD said it is aware of the seriousness of the incident and has identified and implemented additional security options to better protect customer information. The agency added that license sales will continue as planned in August and that it believes current and future customer data is not at risk.
In a statement, TPWD officials said, "We are aware of the seriousness of this incident and have identified and implemented additional security options to better protect customer information. Many of our employees are hunters and anglers and have been affected by this incident. We are committed to implementing enhanced security measures with the license system provider."
Who should take action?
If you have purchased a Texas hunting or fishing license, consider this breach an opportunity to check your accounts and tighten your identity protection. Affected customers can call a dedicated response line at 844-959-7123 to confirm their eligibility for a free one-year credit monitoring service. The deadline for enrollment is September 14, 2026. The call center operates Monday through Friday from 8:00 a.m. to 5:30 p.m. Central Time.
Steps to protect yourself after a data breach
Here are steps you can take following this incident:
- Sign up for credit monitoring or identity theft protection: If eligible, enroll in the free credit monitoring service before September 14, 2026. Credit monitoring can alert you to new credit activity in your name.
- Freeze your credit: A credit freeze makes it harder for new accounts to be opened in your name. You can freeze your credit for free with Equifax, Experian, and TransUnion separately.
- Add a fraud alert: You can create a free one-year fraud alert by contacting one of the major credit bureaus. This alert requires lenders to take extra steps when opening new accounts.
- Report identity theft if you suspect it: If you notice unfamiliar accounts, strange letters, or bills, immediately report it through the FTC's IdentityTheft.gov website.
- Remove your personal information from people-search sites: Reduce the visibility of your name, address, and phone number on these sites using data removal services or manual requests.
- Be cautious about driver's license misuse: Be suspicious of notifications about duplicated licenses, address changes, or traffic issues, and contact the relevant agency directly.
- Stay vigilant against passport fraud: Be cautious of calls or emails reaching out to you about your passport or travel documents; check the official website before sharing your information.
- Be wary of fake TPWD messages: Do not click on links in emails, texts, or calls claiming to be from the Texas Parks and Wildlife Department; visit the official website directly.
- Use strong antivirus software: Use an up-to-date antivirus program to block phishing attempts and detect malicious links.
- Do not share verification codes: Never share verification codes sent to your phone or email with anyone; this is one of the biggest signs of fraud.
- Monitor your financial accounts: Regularly review your bank and credit card statements for small test payments or unfamiliar subscriptions.
- Use strong passwords and two-factor authentication: Create unique, strong passwords for your accounts and enable two-factor authentication on important accounts.
Officials recommend that everyone affected take these steps quickly.
