More than 3 million exposed: the TPWD gap that threatens your identity and how to protect you

The Texas Department of Parks and Wildlife (TPWD) has confirmed a data gap that comes from an external supplier responsible for the licensing system, and that could have exposed personal information of more than 3,087,721 hunting and fishing licence holders in Texas. The intrusion was detected by the Texas Cyber Command which activated an investigation to determine the extent and origin of unauthorized access; the supplier has not yet been publicly identified by the agency.

According to the official notification, there is no evidence that social security numbers, birth dates and financial information such as credit cards have been filtered. What could be compromised is sufficient data to facilitate social engineering attacks: driver's license number, passport, e-mail, telephone numbers and residential addresses. These elements, though not financial, have high value for criminals who create targeted scams, phishing campaigns or even suplanting attempts (SIM swap) and identity theft.

The nature of the information presented poses specific risks: with a driver's license or a passport and contact data, attackers can build convincing messages that appear to be official communications, take victims to fraudulent pages that install malware or attempt to obtain additional credentials, or use data to test access to sensitive services. In addition, the combination of removable personal data in several incidents allows for the construction of synthetic identities that facilitate more sophisticated fraud.

If you are affected, the first thing is to take advantage of any protection service offered by TPWD; the agency has declared that those affected are eligible for a year of free credit monitoring. Beyond that, it is appropriate to request your annual credit report, consider a credit freeze or a fraud alert in the three main agencies - and check the steps to do so in official sites such as AnnualCredit Report.com and the federal portal for identity theft IdentityTheft.gov. These measures do not prevent all attacks, but make it more difficult for a third party to open new accounts in its name.

It is essential to raise surveillance against unexpected post and calls. Do not click on links or download attached files from unsolicited messages, and distrust communications that ask to confirm personal data as a matter of urgency. Activate the Multifactor authentication (MFA) in your accounts (preferably with authentication applications or physical keys instead of SMS) and change passwords to services where you use the same mail or number that may have been exposed.

For public and private organizations that hire third-party services, this incident again highlights the need for more robust supplier risk governance: to review contractual clauses on cybersecurity and incident reporting, to require encryption and registration of access, to conduct periodic assessments and attack simulations, and to maintain continuous monitoring. Federal agency guides on IT supply chain management, such as those published by CISA, provide practical frameworks for reducing risks and improving the response to gaps: CISA Guide to Supply Chain Risk Management.

If you detect suspicious activity linked to your documents (e.g. requests for change of phone number, attempts to access bank services or notices of new accounts), notify your bank and credit agencies immediately, and report to the local authorities. It is also recommended to maintain any communication related to fraud attempts to facilitate future investigations.

Finally, TPWD has indicated that it works with the supplier to implement new safeguards and improve monitoring, but this type of incident recalls that security is a shared responsibility: suppliers must transparency of scope and mitigation measures, agencies must review third-party controls, and citizens must actively protect their information. To check the official notification of the incident and the steps offered by the agency, you can review the communication published by TPWD: TPWD security incident notification (file).