If you hold a Texas hunting or fishing license, your personal details may be in criminal hands. A breach disclosed this month exposed records belonging to about three million license holders — among the biggest data incidents ever to strike the state's outdoor community.
The Texas Parks and Wildlife Department (TPWD) said the Texas Cyber Command flagged the intrusion on May 13, 2026. The weak point was not the agency itself but a third-party vendor that operates its online license platform. That contractor has not been publicly identified, and officials say they still do not know who carried out the attack.
What was taken matters. The compromised files contain driver's license numbers, passport numbers, email addresses, phone numbers and residential addresses — a toolkit for identity thieves and scammers. TPWD emphasised the limits of the breach: "Social Security numbers, dates of birth and financial information, including credit card details were not obtained from this incident." Records for minors were also untouched.
The department noted its own staff were caught up in it. "Many of our staff are hunters and anglers and were affected by this incident," TPWD said, adding that it "took immediate steps" to tighten access controls around customer profiles.
Security analysts are less relaxed. Driver's license and passport numbers cannot be reissued as easily as a bank card, and combined with a name and address they are enough to fuel document fraud and impersonation. The lack of Social Security numbers, they argue, lowers the immediate danger without removing it.
TPWD is providing a year of free Kroll credit monitoring, with enrolment open until September 14, 2026, and has opened a help line at (844) 959-7123 on weekdays. It urged customers to watch their credit reports, weigh a credit freeze, and stay wary of phishing messages that exploit news of the breach. License sales, the agency stressed, are continuing as normal — so summer trips need not be cancelled, even as three million anglers reckon with how their data slipped out the back door of a vendor's server.
