Texas Parks Breach Exposes Data of More Than 3M License Customers

A cybersecurity incident involving the Texas Parks and Wildlife Department’s (TPWD) hunting and fishing license sales system vendor may have exposed personal information for more than 3 million license customers.

Texas Cyber Command detected the incident, which involved the vendor that handles hunting and fishing license sales for the Texas Parks and Wildlife Department. The agency said its investigation indicates that an unauthorized actor may have obtained driver license information, passport numbers, email addresses, phone numbers and residential addresses tied to Texas hunting and fishing license customers.

Social Security numbers, dates of birth and financial information, including credit card details, were not obtained, according to the agency’s notice. The department also said there is no evidence that customers younger than 18 were affected or that any specific group was targeted.

The incident brings attention to the role of third-party systems in state government operations, particularly platforms that support high-volume transactions involving public-facing services. Hunting and fishing licenses are among the department’s core customer services, and the affected system supports sales to customers across the state.

The department has not publicly named the vendor involved in the incident, only that the incident involved the license system vendor that handles hunting and fishing license sales. Public contract records on the agency’s website list Gordon-Darby Inc. as a current vendor for “License Sales System Implement,” with contract and purchase order entries tied to the license sales system. Those records include a $40.1 million contract entry under contract 420614-1 and additional purchase order entries associated with license sales system work.

Gordon-Darby also identifies itself on its website as the company awarded a department contract to implement and manage the license sales system, including the license sales database, point-of-sale deployment and support services.

The incident also comes as the state continues expanding Texas by Texas, the state’s digital assistant known as TxT, across more public-facing services. TPWD has already added boat registration services to the platform through a collaboration with the Department of Information Resources, allowing Texans to link and manage boats, renew registrations, order additional identification cards and replace lost decals or cards. Hunting and fishing license sales, however, remain outside TxT and continue to be directed through Texas License Connection. Neither TPWD nor DIR has publicly said the affected license sales services are planned for migration to TxT.

The agency said it is working with the license system vendor to implement new safeguards and enhanced monitoring services. License sales will continue on schedule for August and the next license year.

The department said it has identified and implemented additional security options to better protect customer information and is continuing to work with the license system vendor to prevent future incidents.