Security Guides
Your fishing licence left your ID number with a vendor you never chose: what Texas hunting and fishing licence holders should do after the TPWD breach
The Texas Parks and Wildlife Department (TPWD) says an unauthorized actor may have obtained driver's license and passport numbers, emails, phones and addresses of hunting and fishing license customers through its license system vendor. What to do, incl. Texas DPS steps.
For: anyone who has bought a Texas hunting or fishing licence (residents and out-of-state visitors, including those who gave a passport number), and anyone who runs a service for a public agency through a vendor. This article is based on TPWD's official notice, the Texas Attorney General's breach list and Texas DPS guidance. It does not cover how the access happened.
What affected licence holders should do today
For the general "driver's licence number exposed" checklist (credit freeze at all three bureaus, credit reports, FTC recovery steps), see our AssuranceAmerica breach guide. The steps below are the ones specific to this incident.
Check the email address you used for your licence
According to the Texas Attorney General's list, notice was given by posting on a website and by email. Look in the inbox you gave when buying your licence. For questions, TPWD's notice gives (512) 389-4820. Call that number yourself rather than any number in an unexpected message.
Freeze your credit, or at least place a fraud alert
TPWD's notice recommends contacting Equifax, Experian and TransUnion to freeze your credit, which it says is free and makes it difficult for identity thieves to open new accounts in your name. It also says you can place a free, one-year fraud alert by contacting any of the three. If your own notice mentions a Social Security number (see below), do the freeze first.
Note that the credit monitoring deadline has passed
TPWD's original notice (archived in June 2026) offered one year of free credit monitoring with an enrollment deadline of September 14, 2026. That date has passed, and the current notice no longer mentions it. Treat any message now offering "late enrollment" with a link as suspicious and confirm by calling TPWD yourself.
If your Texas licence number is misused: police report, then a DPS office
Texas DPS says that if your driver license or ID card is stolen and has been used fraudulently, you should file a police report, then schedule an appointment to bring a copy to a driver license office, where staff will evaluate whether issuing a new number is necessary. DPS's identity theft guide adds that you may be asked to complete a notarized forgery affidavit, and that sheriff's offices can establish a Stolen Identity File reported to a statewide file. Out-of-state visitors should contact their own state's motor vehicle agency instead.
If you gave a passport number, watch for misuse of it
TPWD says passport numbers were exposed only if you had provided one. The passport itself is still in your hands. DPS's identity theft guide lists notifying the U.S. passport authorities among the steps for identity theft victims; if you hold a foreign passport and see signs of misuse, contact the authority that issued it.
Treat 'licence', 'renewal' and 'fine' messages as suspect
TPWD warns that scammers may use personal information to impersonate companies or officials, and advises not clicking links or sharing personal details unless you are certain the request is legitimate. Someone who knows your name, address and licence type can write a convincing "your licence is about to lapse" or "unpaid violation" message. Type tpwd.texas.gov yourself instead (see what is phishing?).
You
Buy a hunting or fishing licence; give DL number (and passport, if provided)
↓→
TPWD (state agency)
Issues the licence; you deal with it every licence year
↓→
Licence system vendor
Handles sales; the incident involved this system
DL number + address
Act: credit freeze; if misused, police report → DPS office
Passport number (if given)
Act: if misused, the passport authority that issued it
Email + phone + licence type
Act: renew and pay only via tpwd.texas.gov you type
SSN, date of birth and card details: not obtained (per TPWD's notice)
What happened (from TPWD's notice and the Attorney General's list)
The following comes from TPWD's notice (current version and the version archived in June 2026) and the Texas Attorney General's data security breach reports list.
May 13, 2026
Texas Cyber Command detects a cybersecurity incident involving the TPWD licence system vendor that handles hunting and fishing licence sales. The Attorney General's entry shows the same discovery date.Investigation
It indicates an unauthorized actor may have obtained driver licence information, passport numbers (if provided), emails, phones and addresses for more than 3 million customers.June 2026
TPWD posts its notice (the earliest public web archive copy is from June 19). It offers one year of free credit monitoring through a dedicated call centre.September 14, 2026
The credit monitoring enrollment deadline. The current notice no longer mentions monitoring and gives (512) 389-4820 for questions.
- Where
- The TPWD licence system vendor that handles the sale of hunting and fishing licences
- May have been obtained
- Driver licence information, passport numbers (if provided), email addresses, phone numbers, residential addresses
- Not obtained
- Social Security numbers, dates of birth, financial information including credit card details
- Scope
- More than 3 million customers. No evidence that customers under 18 were involved or that any specific group was targeted
- Response
- Working with the vendor on new safeguards and enhanced monitoring; immediate steps to strengthen access controls for customer profile data; more security features planned
- Licence sales
- Continued on schedule for the 2026-27 licence year
- Contact
- (512) 389-4820
How to read it: the Attorney General's list and TPWD's notice differ on SSN
The information-type fields in the Attorney General's entry list name, address, Social Security number, driver's licence number, government-issued ID number, date of birth and "other". TPWD's notice says Social Security numbers and dates of birth were not obtained. This site couldn't find an explanation for the difference, and we don't assume either is wrong. In practice: follow the notice you received, and since a credit freeze costs nothing, placing one covers both readings.
A government record held by a vendor: what's different here
In most breaches, you chose the company. Here you chose a state licence; the vendor came with it.
What you couldn't control
- Which vendor runs the licence system, and how it stores ID numbers
- That the record exists: hunting and fishing need a licence, and you'll renew it
- That the same agency will contact you again, which scammers can imitate
What you can control
- Optional fields: passport numbers were exposed only "if provided"
- Where you renew and pay: a TPWD address you type, not a link
- Your credit file: a free freeze or fraud alert, as TPWD recommends
- The DPS route: police report → driver licence office, if the number is misused
This site's view: with government forms, 'optional' is a real choice
In the AssuranceAmerica breach, licence numbers leaked from an insurer you picked. Here they leaked from a system you reached through a government agency. The lesson for individuals is small but concrete: when a government or vendor form marks an ID number as optional, leave it blank unless you need it. TPWD's own wording, "passport numbers (if provided)", shows that optional fields end up in the same database as required ones.
For agencies and the vendors that run their systems, TPWD's first step, tightening access controls on customer profile data, is the general lesson too: decide in the contract who can read full ID numbers, how many records at once, and how quickly the agency will be told. See the minimum security baseline for organizations. The French ANTS breach is another 2026 case involving a government system that handles citizens' ID paperwork.
Sources (public record)
The facts in this article are based on the public information below. The vendor's name, undisclosed attack methods and attacker claims are not used.
- Texas Parks and Wildlife Department, "Notification of Data Security Incident" (current version, checked September 30, 2026) — tpwd.texas.gov
- Same notice, as archived on June 19, 2026 (credit monitoring offer and deadline) — web.archive.org
- Office of the Texas Attorney General, "Data Security Breach Reports" (Texas Parks and Wildlife: 3,087,721 Texans, 3,187,000 total) — oag.my.site.com
- Texas Department of Public Safety, "Replace your Driver License, Commercial Driver License or ID Card" (Report Stolen Cards) — dps.texas.gov
- Texas DPS, "Identity Theft Information Guide" — dps.texas.gov
Update history
2026-09-30: First version, based on TPWD's notice (current and June 2026 archived versions), the Texas Attorney General's breach list (checked September 30, 2026) and Texas DPS guidance. We will update it if TPWD publishes more.
Read next
- The general checklist for licence-number leaks: AssuranceAmerica (US: ~7 million driver's licence numbers)
- Government ID systems: France Titres (ANTS) / Odido (Netherlands: passport and licence numbers)
- Scams that follow a breach: What is phishing? / Choosing a password manager
- Other 2026 incidents: List of breaches and cyberattacks (Japan and worldwide)
- For operators: The minimum security baseline for organizations
FAQ
QWhat was exposed in the Texas Parks and Wildlife breach?
According to TPWD's notice, the investigation indicates that an unauthorized actor may have obtained driver license information, passport numbers (if provided), email addresses, phone numbers and residential addresses for more than 3 million Texas hunting and fishing license customers. TPWD says Social Security numbers, dates of birth and financial information, including credit card details, were not obtained, and that there is no evidence customers under 18 were involved or that any specific group was targeted.
QHow many people were affected?
TPWD's notice says more than 3 million customers. The Texas Attorney General's data security breach reports list shows 3,087,721 Texans affected and a total of 3,187,000 individuals, with notice given by posting on a website and by email.
QThe Attorney General's list mentions Social Security numbers. Which is right?
The information-type fields in the Texas Attorney General's entry include Social Security number and date of birth, while TPWD's notice says those were not obtained. This site could not find an explanation for the difference. Follow what your own notice says, and since a credit freeze is free, placing one covers both cases.
QIs credit monitoring still available?
TPWD's notice as archived in June 2026 offered affected customers one year of free credit monitoring, with an enrollment deadline of September 14, 2026. That deadline has passed, and the current notice no longer mentions monitoring. It recommends a free credit freeze or a free one-year fraud alert with the three credit bureaus, and gives (512) 389-4820 for questions.
QWhat can I do if my Texas driver's license number is misused?
The Texas Department of Public Safety (DPS) says that if your license or ID card is stolen and has been used fraudulently, you should file a police report and schedule an appointment to bring a copy to a driver license office, where staff will evaluate whether issuing a new number is necessary. DPS's identity theft guide also describes a notarized forgery affidavit and the Stolen Identity File kept through sheriff's offices.
QI don't live in Texas but bought a licence there. Am I affected?
Possibly. The Attorney General's entry shows 3,187,000 individuals in total against 3,087,721 Texans, so roughly 99,000 of the people counted live outside Texas. If you bought a Texas hunting or fishing licence, check the email address you used for a notice and call TPWD at (512) 389-4820 if unsure. Your own state's motor vehicle agency, not Texas DPS, handles your driver's licence.