Texas Parks and Wildlife vendor breach exposes 3 million license holders

On 18 June 2026, the Texas Parks and Wildlife Department (TPWD) — the state agency that issues hunting and fishing licences to Texans — publicly disclosed a data breach at the third-party vendor that processes its licence sales, exposing the personal information of more than three million people. It is one of the largest US state-government data breaches disclosed so far in 2026, and a fresh reminder of the outsized risk that outsourced service providers pose to public-sector data.

What happened

According to TPWD, the breach did not occur on its own systems but on those of an external vendor that processes hunting and fishing licence transactions on the department's behalf. Texas Cyber Command detected unauthorised access to the vendor's environment and notified TPWD on 13 May 2026. The department published a formal Notification of Data Security Incident on 12 June 2026 and made a broader public disclosure on 18 June 2026.

The agency said its investigation had not determined when the initial intrusion occurred, how the attacker gained entry, or how long they had access. The vendor behind the breach was not publicly named, and as of disclosure no other states had reported a related incident.

Impact

TPWD said the exposed data covered 3,087,721 individuals and included driver's licence numbers, passport numbers (where customers had provided them), email addresses, phone numbers and residential addresses. The department stated that Social Security numbers, dates of birth and financial information — including credit-card details — were not obtained in the incident.

In response, TPWD set up a dedicated breach call centre and offered affected individuals free credit monitoring, with an enrolment deadline of 14 September 2026. No threat actor has claimed responsibility, and the department has not reported any ransom demand.

Why it matters

The breach highlights how a government agency's data is only as secure as the vendors it entrusts with citizen records. Driver's licence and passport numbers are durable identifiers that fuel identity theft and fraud for years, and their exposure at scale is far harder to remediate than a password reset. The incident underscores why public bodies should hold third-party processors to the same security and breach-notification standards as their own systems, and inventory exactly which sensitive fields those vendors hold.