Loading story…
Texas Parks & Wildlife disclosed a data breach affecting more than 3 million people after the state’s cybersecurity unit detected unauthorized access involving the department’s license system vendor. The exposed data was tied to hunting and fishing license transactions and included driver’s license numbers, passport numbers, email addresses, phone numbers, and residential addresses, according to reporting and statements attributed to the Texas attorney general.
The agency said the intrusion involved a vendor system used to process license information, but it did not identify the vendor or disclose the exact timing or method of the compromise. Officials also did not say whether the attackers had contacted the department, leaving key questions unanswered as the incident stands as one of the largest reported data breaches affecting Texas this year.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A threat actor using the alias Shadowreaper was observed advertising the sale of what was claimed to be a full Texas Parks and Wildlife Department database exfiltration after the agency's breach disclosure. The listing, seen on June 23, 2026, included unverified claims of additional Social Security number, date-of-birth, and payment card data beyond what TPWD officially confirmed.
Texas Parks & Wildlife said affected Texas residents would receive one year of free credit monitoring through Kroll following the breach affecting hunting and fishing license customers. The agency also said it was strengthening access controls and network monitoring in response to the incident.
Texas Parks & Wildlife disclosed a data breach affecting more than 3 million people after unauthorized access involving the department's license system vendor was detected. Exposed data tied to hunting and fishing license holders included driver's license information, passport numbers, email addresses, phone numbers, and residential addresses.
Texas Parks and Wildlife said it notified Texas Cyber Command on May 13 after discovering a breach involving an unnamed third-party vendor tied to hunting and fishing license sales. The agency also said its investigation had not yet determined when the breach occurred.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
securitymagazine.com
Open sourcedarkwebinformer.com
Open sourcemalwarebytes.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcetpwd.texas.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AssuranceAmerica disclosed a data breach affecting **6.99 million people**, exposing names, contact details, **driver’s license numbers**, and other insurance-related information tied to auto insurance policies, accounts, drivers, vehicles, and customer claims. The company said it discovered attackers in its systems on March 17 and completed its investigation on June 15, concluding that customer data had been stolen in what appears to be the largest known reported exposure of Americans’ driver’s license information this year. The insurer said the intrusion involved a targeted employee account and that the compromised credentials were later disabled, but it did not disclose the exact intrusion method or whether extortion or ransom demands were involved. Filings with the Indiana and Maine attorney general offices corroborated the scale of the breach, and customer notification letters are expected to begin on July 10.
Jul 10, 2026
Over 4 million Texans have been affected by a significant data breach at Conduent Business Services, marking one of the largest such incidents in U.S. history. The breach has prompted legal action and investigations, with the potential for compensation for impacted individuals. In a separate incident, Doctor Alliance, a healthcare technology firm serving multiple providers, suffered a cyberattack resulting in the theft of over 1.2 million records. Attackers have threatened to release sensitive medical data, including diagnoses, prescriptions, and insurance information, unless a ransom is paid, raising serious concerns about identity theft and medical fraud. Additionally, The Thayer Hotel in New York experienced a breach in which more than 33,000 individuals had personal information stolen, including government-issued IDs and, in some cases, Social Security numbers. The hotel, located near the West Point Military Academy, has offered affected individuals free identity theft protection. While there is no evidence yet of misuse, the stolen data could be leveraged for phishing, identity theft, or malware attacks, especially given the military-affiliated clientele. These incidents highlight the ongoing risks posed by cyberattacks targeting organizations that handle sensitive personal and medical information.
Jul 12, 2026
National Public Data disclosed a security incident affecting a large repository of consumer background-check and people-search information, with exposed data reported to include highly sensitive personal identifiers such as **Social Security numbers**, names, mailing addresses, and other profile details. The company published a breach notice on its website, while an individual notification letter filed with the California Attorney General indicates affected residents were formally notified that their information may have been involved. The incident drew attention because the compromised records appear to involve data commonly used for identity verification and fraud, increasing the risk of **identity theft**, account takeover, and social-engineering abuse. The notification materials show the breach response included direct notice to impacted individuals and guidance on protective steps such as monitoring accounts and credit activity, underscoring the seriousness of the exposure for consumers whose records were held by the data broker.
Jul 12, 2026