Texas Parks & Wildlife (TPWD) Data Breach Affects 3 Million Individuals
Published
Key Takeaways
- Breach Disclosed: The Texas Parks and Wildlife Department (TPWD) confirmed a data breach affecting more than 3 million individuals.
- Data Exposed: Compromised records include email addresses, physical addresses, phone numbers, driver's license information, and passport numbers.
- Source Identified: A third-party vendor handling hunting and fishing license sales suffered a cybersecurity incident.
The Texas Parks and Wildlife Department (TPWD) has disclosed a data breach affecting roughly 3 million individuals who acquired hunting and fishing licenses. TPWD is the state agency responsible for conserving Texas's natural resources, managing wildlife and state parks, and overseeing hunting and fishing programs.
How the TPWD Breach Was Discovered
TPWD learned of the data breach from the Texas Cyber Command, which flagged a cybersecurity incident involving an unnamed third-party vendor that sells hunting and fishing licenses. The exposed data includes 3,087,721 Texans’:
- email addresses,
- physical addresses,
- phone numbers,
- driver's license information,
- passport numbers.
TPWD confirmed that Social Security numbers, dates of birth, and financial information, including credit card details, were not obtained in this incident.
The agency stated there is no evidence that customers under the age of 18 were involved or that any specific group was targeted.
TPWD Response and Remediation
License sales remain unaffected, and TPWD says it is working with the license system vendor to strengthen its cybersecurity posture. "Immediate steps were taken to strengthen access controls for customer profile data, and additional security features will be added in the future," TPWD noted.
The name of the targeted vendor has not been disclosed, and the threat actor behind the attack remains unidentified.
In other news, 140,000 Ralph Lauren accounts were exposed via the ShinyHunters Salesforce breach.
Last week, Nintendo confirmed that TinyPulse data was stolen in an extortion attack, Amazon’s One Medical announced a data breach following ShinyHunters theft claim, and Australian Clinical Labs reported a SunDoctors data breach.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular