Texas Parks & Wildlife vendor breach hits 3M license holders

The Texas Parks and Wildlife Department (TPWD) disclosed on June 18, 2026 that a breach at its third-party hunting- and fishing-license vendor exposed personal information for more than 3 million Texas license customers. The vendor — which runs the licensing platform on TPWD's behalf — has not been publicly named. The full notice is on the department's site at tpwd.texas.gov, and SecurityWeek corroborates the scope.

TPWD says Texas Cyber Command detected the unauthorized access first, and TPWD was notified on May 13, 2026. The department published its formal notification on June 12 and made the breach public on June 18. Kroll is running the response.

What was exposed

According to TPWD, an unauthorized actor "may have obtained":

• Driver's license numbers.
• Passport numbers (where the customer had provided one).
• Email addresses.
• Phone numbers.
• Residential addresses.

TPWD explicitly states the following were not taken:

• Social Security numbers.
• Dates of birth.
• Financial information, including credit card details.

There is no evidence customers under 18 were involved, and the department says there is no sign a specific group was targeted.

Who is affected

Anyone who has bought a Texas hunting or fishing license through the vendor's system. That's a regular feeder pool every year — kids' fishing licenses, deer-season permits, lifetime licenses, the lot. TPWD's number is more than 3 million individuals, which is consistent with the volume of licenses Texas sells annually.

Attribution

None public. TPWD has not named the threat actor, no ransom demand has been disclosed, no leak post has been reported on a known cybercrime forum. The investigation is being run by Texas Cyber Command, which stood up in 2025 under the Texas Department of Information Resources, with TPWD and the unnamed vendor cooperating. Treat any "X group claims TPWD" post you see in the next 48 hours skeptically until it's tied to verifiable samples.

What to do today

1. If you bought a Texas hunting or fishing license in the last several years, assume your driver's license number is in the dataset and, if you ever provided it, your passport number too. Set a fraud alert at any of the three credit bureaus (Equifax, Experian, TransUnion); one alert propagates to the other two.
2. Enroll in the free year of Kroll credit monitoring TPWD is offering. Eligibility line: (844) 959-7123. The enrollment deadline is September 14, 2026 — don't sit on it.
3. Watch for hunting- and fishing-themed phishing. The leaked combination — name, address, phone, plus a license context — is a clean lure for "renew your license," "rebate," or "stamp expired" emails and SMS. Renew only through the official portal at tpwd.texas.gov, never via a link in a received message.
4. Texas state IT operators: the breach is at a third-party vendor, not at TPWD. If you run any contract with the same kind of B2G SaaS profile — high-volume citizen data, low-margin operator, single integration point — audit the contract's incident-notification SLA and the vendor's actual security posture (SOC2 dates, pentest cadence, network segmentation) this week.

Context

The pattern is by now boring. Citizen-facing state services contract a SaaS vendor to run the transactional layer; the vendor holds the lake of PII; the vendor gets breached; the state agency owns the public disclosure. The 2024–2026 run of US state-government data incidents tracks the same shape: the agency name is on the headline, but the systems compromised are the vendor's. Massachusetts unemployment, Maine's MOVEit-driven exposures, Oregon DMV — same template.

For TPWD specifically, the silver lining is narrow but real: no SSNs, no DOBs, no card data. That's not "no harm" — driver's licence and passport numbers are perfectly serviceable for SIM-swap, account-recovery abuse, and synthetic identity. But the absence of full-spectrum identity data limits how cleanly the dataset can be turned into pre-built fraud kits, which is partly why no actor has rushed to monetize it publicly.

The unnamed vendor question is the one to watch. TPWD's notice will be followed, sooner or later, by a regulator filing (Texas Attorney General data-breach portal, or the multistate AGs if non-Texas residents bought licenses) that identifies the operator. When the vendor's name lands, expect to find them running similar licensing platforms for other state agencies — at which point the blast radius is no longer just Texas.