What You Need to Know About the Texas Driver's License Data Breach

A payment processing company that handles transactions for the Texas Department of Public Safety was breached, exposing the driver's license records of roughly 27.7 million Texans, according to the Texas Department of Public Safety. The compromised information includes driver's license numbers, home addresses, dates of birth, and vehicle registration history. Importantly, the breach happened at the vendor's servers, not at DPS's own systems.

The payment processor discovered the problem in December 2022. It noticed unusual activity on its accounts and alerted DPS to the breach. The exposure occurred before anyone detected stolen files actively being removed—instead, the vendor spotted suspicious patterns in how the accounts were being used, similar to how a bank might flag a credit card being tested repeatedly with small charges.

Why This Matters

A driver's license number on its own is not particularly dangerous. A home address alone does not give someone much power. But the three pieces together—license number, address, and date of birth—form what companies call an "identity bundle." These are the exact details that financial institutions, government agencies, and insurance companies often use to verify your identity when you call or apply online. Someone with this information could potentially open fraudulent accounts in your name or target you with convincing, personalized phishing scams.

The scale of this breach is significant. The data covers a large portion of Texas's adult population, making it a valuable trove for identity fraud and targeted scams.

The Vendor Problem

Here lies a broader issue that government and business have been dealing with for years. When a state agency like DPS needs to accept payments or handle sensitive transactions, it typically hires a separate company to do that work. That company becomes a link in the chain. Even if DPS locks down its own computers and networks perfectly, it remains vulnerable through its vendors. In this case, DPS's defenses held, but the weak link was elsewhere—in a company DPS hired to process payments on its behalf.

This raises a practical question for other government agencies right now. A vendor might have impressive security certifications on paper, but what really matters is whether the vendor shares its monitoring data with the agency in real time. If the vendor is the only one watching its own systems, then both the vendor and the agency stay blind to threats until the vendor decides to speak up.

What You Should Do

If you have a Texas driver's license, DPS recommends you place a security freeze with the three major credit bureaus (Equifax, Experian, and TransUnion). This makes it harder for someone to open new accounts in your name. You should also monitor your credit report for unexpected new accounts and watch for phishing emails or calls that might reference personal details they now have—your address, for instance, or a vehicle you own.

The Texas Department of Public Safety has posted detailed guidance for affected individuals on its driver license security incident page.