{“lastseen”:”2026-06-23T11:36:50″,”description”:”You can change a password and cancel a card. But replacing a passport or driver’s license number every time someone leaves yours unsecured in a vendor database isn’t so easy. \\n\\nMore than three million Texans are facing that problem after a data breach involving a vendor used by the Texas Parks and Wildlife Department (TPWD) to process hunting and fishing licenses.\\n\\nIn an announcement confirming the breach, TPWD says the hackers gained access through the third-party vendor’s systems and exposed personal information belonging to 3,087,721 people. The agency says the exposed data may include driver’s license information, passport numbers, email addresses, phone numbers, and residential addresses.\\n\\nHowever, exactly what information was stolen remains unclear.\\n\\n## Conflicting accounts of what was exposed\\n\\nIn a breach notification filed with the Texas Attorney General’s office, TPWD said the incident affected:\\n\\n * Name of individual\\n * Address\\n * Social Security number information\\n * Driver’s license number\\n * Government-issued ID number (e.g. passport, state ID card)\\n * Date of birth\\n\\n\\n\\nWhen we asked them for clarification, TPWD referred us to the same public statement they put on the website, which lists this data as possibly stolen:\\n\\n * Driver license information\\n * Passport numbers (if provided)\\n * Email addresses\\n * Phone numbers\\n * Residential addresses\\n\\n\\n\\nIt explicitly said that Social Security numbers, dates of birth, and financial information, including credit card details, **were not** included in the incident.\\n\\n\\u003e \\”Social Security numbers, dates of birth and financial information, including credit card details were not obtained from this incident.\\” \\n\\nThose two lists don’t tally up, leaving Texans unclear as to exactly what information has been stolen.\\n\\nTPWD has not identified the third-party vendor involved in the incident. It also declined to answer questions about when it first learned of the breach, how the attackers gained access to the data, or what specific security controls failed.\\n\\nTPWD did say it is working with the license system vendor to implement increased safeguards. It didn’t say what those safeguards were, though, or exactly how the information was stolen in the first place.\\n\\n## Not the first major Texas data exposure\\n\\nThis isn’t the Texas government’s first data breach rodeo, which matters because criminals often combine data from multiple leaks. Information that seems limited on its own becomes much more useful when paired with other stolen data.\\n\\nIn 2020, software vendor Vertafore exposed records belonging to nearly 28 million Texas drivers by leaving the data in an unsecured external storage service, according to a StateScoop investigation. \\n\\nIn January last year, the Texas Department of Health and Human Services informed people that its employees had been stealing their data. At least 61,000 people were affected, it said at the time, before expanding that number in April to at least 94,000.\\n\\nThe latest breach, and the admission that government IDs were among the stolen data, may also complicate the Texas government’s repeated attempts to introduce digital identity programs. Senate Bill 215, which proposed a state digital ID for citizens, didn’t make it past committee.\\n\\n## If you bought a Texas hunting or fishing license\\n\\nTPWD has offered affected individuals one year of free credit monitoring through Kroll. Enrollment closes September 14, 2026. \\n\\nIf you may have been affected:\\n\\n * Freeze your credit with Equifax, Experian, and TransUnion to make it harder for identity thieves to open accounts in your name.\\n * Enroll in the Kroll credit monitoring before September 14, 2026.\\n * Watch for phishing emails and texts referencing TPWD, fishing licenses, or the breach itself. Leaked emails and phone numbers are exactly what scammers use next.\\n * Be suspicious of anyone who contacts you unexpectedly and asks you to verify driver’s license, passport, or other personal information.\\n\\n\\n\\nWhether Texas ever reveals the vendor’s identity remains to be seen. What is certain is that the personal information of more than three million Texans is now in criminal hands.\\n\\n* * *\\n\\n**Your name, address, and phone number are probably already for sale. ** \\n\\nData brokers collect and sell your personal details to anyone willing to pay. Malwarebytes Personal Data Remover finds them and gets your information removed, then keeps watch so it stays that way. \\n\\nSCAN NOW”,”published”:”2026-06-23T10:30:57″,”modified”:”2026-06-23T10:30:57″,”type”:”malwarebytes”,”title”:”Hackers steal passport and driver\\u0026#8217;s license data of 3 million Texans”,”source”:””,”references”:””,”id”:”MALWAREBYTES:9D69E222B6856BBA3932F0F2D0EB9073″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/data-breaches\/2026\/06\/hackers-steal-passport-and-drivers-license-data-of-3-million-texans”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-23T11:36:50″,”description”:”You can change a password and cancel a card. But replacing a passport or driver’s license number every time someone leaves yours unsecured in a…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-65002","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n