Texas investigates 2 major data breaches
Prapass Pulsub via Getty Images
By
Chris Teale
Around 3 million hunting and fishing license customers in the state had their data exposed, according to a recent notification, while another 800,000 cruise line customers had their data breached.
Texas officials are investigating two high-profile data breaches that have left over 3 million residents with their personal information illegally exposed.
The Texas Parks and Wildlife Department said in a notification earlier this week that around 3 million hunting and fishing license customers might have had their information unlawfully obtained from the state’s license system vendor by an unauthorized actor.
The department said the hackers might have acquired driver license information, passport numbers, email addresses, phone numbers and residential addresses, but did not obtain Social Security numbers, dates of birth or financial information, including credit card details.
“We recognize the seriousness of this issue and have identified and implemented additional security options to better protect customer information,” TPWD said in a statement. “Many of our staff are hunters and anglers and were affected by this incident. We are committed to continuing to work with the license system vendor to implement increased safeguards to prevent future incidents.”
The agency said it is “working closely” with its license system vendor to implement new safeguards and enhanced monitoring services and said it took “immediate steps” to strengthen access controls for customer profile data, noting that additional security features will be added in the future. TPWD said license sales would continue on schedule for August and the next license year.
The incident was detected by Texas Cyber Command, which went live last year after being established in law in June 2025. Cyber command assumed many of the cybersecurity roles previously held by the state’s Department of Information Resources, known as DIR.
Ret. Admiral TJ White, the cyber command’s first chief, said previously that the organization would be a “down and in” organization focused proactively on threat intelligence, incident response and day-to-day operations, as well as an “up and out” organization with an events management, public engagement and outreach arm.
Separately, Texas Attorney General Ken Paxton announced an ongoing investigation into Carnival Cruises over a data breach that compromised the information of more than 6 million people, including over 800,000 Texas residents. That investigation came after the company’s IT security team identified unauthorized activity involving an employee’s account in April and determined that social engineering was used to fool an employee and gain access to Carnival’s systems.
The personal information exposed could include names, contact details, dates of birth, payments, passports, driver’s licenses, health notes and other identifying details. Carnival’s Privacy Notice also says that it may collect device content, including photos from a camera roll and contacts from an address book, with the customer’s permission.
In a statement, Paxton said data breaches “are a serious matter” and the state is working to “ensure that the company is held accountable for any illegal action and that Texans' private information is properly secured.” The company disclosed the breach under Texas law 44 days after it is alleged to have taken place.
Data breaches are increasingly common, especially in state and local agencies that are responsible for managing large volumes of personal data and so have become attractive targets for hackers and cybercriminals. Elsewhere in the country, hackers linked to rival nation-states, including Iran, have been blamed for attacks on various agencies and utilities.
And while consumers’ initial reaction might be to panic after such a breach, Jurgis Plikaitis, CEO of ClearNym, a personal data privacy platform, urged them to “dial back the hysteria” as the real danger from such a hack isn’t in the immediate days afterwards. Instead, Plikaitis said, hackers can hold onto personal information and wait years to use it, after free credit monitoring has stopped and after people have stopped paying attention.
Cleansing any personal information available from data brokers and in the public domain that stolen data can be matched against can help prevent further damage down the road, Plikaitis said.
“In Texas, they require you to verify yourself through your driver's license in order to confirm your age,” he said in an email. “And 3 million IDs from the vendor they hired are now lost… The more online services require you to scan your driver's license, the more copies of yourself will be sitting in databases you'll never see, waiting to be used someday.”