Loading story…
Kaufman County, Texas, experienced two separate cybersecurity incidents in October, with the most recent attack confirmed on October 20. County officials acknowledged that personal information, including names and Social Security numbers, may have been accessed during the earlier breach, prompting notifications to affected residents and the offer of complimentary identity protection services. While there is no evidence of misuse of the compromised data, concerns have been raised about the adequacy of the county's cybersecurity measures following these repeated incidents.
The latest cyber intrusion resulted in the shutdown of various county systems, including courthouse computers, though emergency services and the Sheriff's Office remained operational. These attacks on Kaufman County occurred alongside other cyber incidents affecting government services in Tennessee and Indiana, highlighting a broader trend of increased cyber threats to local governments amid reduced cybersecurity resources and support at the federal level.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Following confirmation of the second breach, Kaufman County notified affected residents through Cyberscout and offered 24 months of complimentary identity-protection services via TransUnion. Officials said there was no evidence of misuse at the time and advised residents to monitor their credit reports.
A second, separate cybersecurity incident affecting Kaufman County was confirmed on October 20, 2025. County officials indicated that personal information, including names and Social Security numbers, may have been accessed.
Kaufman County, Texas, experienced an initial cybersecurity incident in early October 2025, the first of two separate attacks reported within a three-week span. Public reporting does not identify the threat actor or attack method for this first incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Washburn County, Wisconsin disclosed that it is responding to a cybersecurity incident after detecting suspicious activity on the morning of August 6. County officials said they immediately activated incident response procedures, engaged external cybersecurity professionals and other partners, and began investigating the scope of the intrusion while working to restore affected technology services safely. Reporting on the incident said county systems were shut down following the attack, while the county's public notice stated the investigation was still ongoing and officials had not yet determined the exact nature of the attack, which systems were compromised, or who was responsible. The event has been presented as an active local government cyber incident, with service disruption and forensic review continuing as authorities assess potential impact.
Aug 10, 2026
Over 4 million Texans have been affected by a significant data breach at Conduent Business Services, marking one of the largest such incidents in U.S. history. The breach has prompted legal action and investigations, with the potential for compensation for impacted individuals. In a separate incident, Doctor Alliance, a healthcare technology firm serving multiple providers, suffered a cyberattack resulting in the theft of over 1.2 million records. Attackers have threatened to release sensitive medical data, including diagnoses, prescriptions, and insurance information, unless a ransom is paid, raising serious concerns about identity theft and medical fraud. Additionally, The Thayer Hotel in New York experienced a breach in which more than 33,000 individuals had personal information stolen, including government-issued IDs and, in some cases, Social Security numbers. The hotel, located near the West Point Military Academy, has offered affected individuals free identity theft protection. While there is no evidence yet of misuse, the stolen data could be leveraged for phishing, identity theft, or malware attacks, especially given the military-affiliated clientele. These incidents highlight the ongoing risks posed by cyberattacks targeting organizations that handle sensitive personal and medical information.
Jul 12, 2026
Nacogdoches Memorial Hospital in Texas disclosed that a January cyberattack exposed the personal and medical information of **257,073 patients** after attackers gained access to its network on **January 15** and remained undetected for roughly two weeks. Public reporting and breach notification materials indicate the stolen data included names, Social Security numbers, medical record numbers, health insurance and health plan beneficiary details, and other sensitive healthcare information; the hospital also said patient photos may have been affected. The regional medical center said it has not identified misuse of the stolen data so far, but the scale and sensitivity of the breach make it a significant healthcare privacy incident. In response, the hospital said it implemented additional network security measures and security awareness training, while reports noted it did **not** offer complimentary credit monitoring to affected individuals and did not provide further detail on the intrusion or whether employee and support staff data was also compromised.
Jun 29, 2026