TxDOT Account Breached, Nearly 300,000 Crash Reports Stolen

In June 2025, hackers accessed a TxDOT account and stole almost 300,000 crash reports containing names, addresses, driver’s license numbers, and other personally identifiable information. This breach exposed sensitive licensing details to attackers who could use them for identity theft or fraud.¹

The attack likely leveraged Active Directory authentication; a single compromised credential can grant access across multiple systems within a legacy IT environment. Similar incidents have targeted government entities before—most notably the Office of Personnel Management (OPM) breach in 2015, which revealed data from over 21 million individuals due to weak password policies across federal networks. The TxDOT incident underscores how outdated security practices still pose significant risks to public agencies.

Security specialists note that while multi‑factor authentication (MFA) is often deployed by state agencies, attackers frequently bypass it through phishing campaigns or malware implants. In this case, the perpetrators probably tricked users into revealing credentials or installed malicious software that captured login tokens. MFA remains effective only when combined with robust user training and continuous monitoring for suspicious activity.

Crash reports are especially valuable because they contain personal identifiers. When paired with such data, these datasets become potent tools for identity thieves seeking to open fraudulent accounts or commit financial crimes. The exposure of nearly 300,000 documents raises concerns about how PII is handled by state agencies and whether additional safeguards like encryption at rest and strict access controls should be mandated.

Experts predict that ransomware groups will increasingly target government infrastructure given its perceived wealth and critical services. Past attacks on state agencies—including Georgia’s Department of Driver Services in 2017—exposed over three million records, demonstrating that even well‑protected systems can fall victimized by social engineering. This trend highlights a persistent challenge: legacy IT environments lag behind private sector best practices, making them attractive targets for cybercriminals who seek high‑value data.

The TxDOT breach serves as a reminder that public entities must prioritize password hygiene, enforce least privilege principles, and adopt real‑time threat detection mechanisms. Immediate investigations into the handling of crash report data are essential; any gaps could enable attackers to harvest sensitive information quickly before remediation steps take effect. Strengthening authentication methods, rotating API keys, and conducting regular penetration tests may help prevent similar incidents in the future.

The June 2025 incident demonstrates that even large state agencies remain vulnerable when legacy systems lack modern security measures. Addressing these weaknesses promptly can protect citizens’ personal data from falling into malicious hands.