A Fishing License Shouldn't Cost You Your Passport Number

If you bought a Texas hunting or fishing license, the state may have just handed your driver's license number and your passport number to whoever wanted them. 3,087,721 people. Through a vendor Texas still won't name.

Here's what's confirmed. Texas Cyber Command detected unauthorized access to the licensing vendor's systems on May 13, 2026. The Texas Parks & Wildlife Department posted its breach notice on June 12 and the story reached the public in mid-June. What walked out the door: driver's license information, passport numbers, email addresses, phone numbers, and home addresses. TPWD says it has no evidence anyone under 18 was involved. The count is not a round number — it's 3,087,721 hunters and anglers, which is roughly one in ten Texans (the state's population was 31,709,821 as of July 2025).

Sit with the kind of data this is. A password, you can change in thirty seconds. A driver's license number and a passport number, you cannot. This isn't a leaked login — it's a permanent identifier, handed to the people who collect exactly these to plan what comes next.

Two failures own this, and neither is the hacker.

The first is collection. A state agency required passport-grade identifiers to sell fishing licenses, then parked three million of them with a third-party contractor. Data minimization is a principle that exists for exactly this moment: you cannot lose what you never collected. Why does catching a bass require a passport number on file?

The second is the name that's missing. Three million Texans get to learn their passport numbers are gone — but not who lost them. The vendor's identity is still withheld. Accountability with the responsible party redacted isn't accountability; it's a press release.

And before anyone calls this a clean response: Texas's own breach law (Tex. Bus. & Com. Code § 521.053) gave TPWD up to 60 days to notify you and 30 days to notify the Attorney General. Detected May 13, noticed June 12 — they appear to have met the clock. That's the whole problem in one sentence. Meeting the clock and protecting people are not the same thing. The statute sets a floor for the apology. It sets no floor for the duty of care that would have kept your passport number off a vendor's server in the first place.

Then there's the remedy: one year of free credit monitoring through Kroll. A passport number does not expire in a year. Neither does a driver's license number. One year of monitoring for an exposure that is effectively permanent is a receipt, not a fix.

So take the receipt — you already paid for it with your data. If your name is in that three million, enroll with Kroll before September 14, 2026, or call TPWD's breach line at (844) 959-7123. Then ask the question the free monitoring is designed to make you stop asking: why did a fishing license require your passport number, and who is the vendor that lost it?

Sources: KXAN; Houston Public Media / Texas Public Radio; BleepingComputer; Security Affairs; Texas Parks & Wildlife Department breach notice. Population: U.S. Census Bureau (Texas, July 2025). Statute: Tex. Bus. & Com. Code § 521.053.