Texas Parks and Wildlife breach may expose three million people

More than three million people may have had personal data exposed in a breach at the Texas Parks and Wildlife Department. According to disclosures, attackers gained unauthorised access to driver's licence information, passport numbers, email addresses, phone numbers and home addresses.

This is the kind of breach that does lasting damage, because of what was taken. A password you can change in two minutes. A driver's licence number and a passport number you cannot. That combination, paired with a name, address and phone number, is the raw material for identity theft: opening accounts in someone else's name, passing identity checks, redirecting mail and more.

Who this affects and what to do

If you have interacted with the Texas Parks and Wildlife Department, for a hunting or fishing licence, a park booking or anything that required ID, assume your details could be in this set and act accordingly. Watch for targeted phishing: criminals who hold your real address and phone number can craft messages that look convincing precisely because the details check out.

Consider placing a fraud alert or credit freeze if that option is available to you, which makes it harder for anyone to open credit in your name. Be sceptical of unexpected calls or emails referencing your personal details, since knowing your address does not make a caller legitimate. And never act on a security warning that arrives by phone or text and pushes you to move money or hand over codes. That urgency is the tell.

Government bodies holding this volume of sensitive identity data carry a particular responsibility, and breaches like this one are a reminder that the data you are required to hand over does not always get the protection it deserves. You cannot control how an agency stores your passport number. You can control how quickly you react when it leaks.