October is Cybersecurity Awareness Month, and this year there are two official themes instead of one. CISA is running “Securing the Next 250,” tied to the country’s 250th anniversary. The National Cybersecurity Alliance is running “Don’t Make It Easy for Them,” which argues that safety online comes from small habits repeated rather than one perfect decision.
The awareness-month ritual gets eye-rolls, and some of that is earned. A poster in the breakroom does not change much. But if you live in Texas, the last six months have handed you a specific and unusually clear reason to spend two hours on this. Your data was almost certainly part of it.
The Texas roll call
In June, the Texas Parks and Wildlife Department disclosed that an unauthorized actor had reached the vendor running its hunting and fishing license system. More than three million license customers were affected. Texas Cyber Command detected the intrusion, and TPWD said the exposed data included driver license information, passport numbers, email addresses, phone numbers, and home addresses. Social Security numbers, birthdates, and payment card data were not taken.
Read that list again. Driver license and passport numbers are not credentials you can rotate. You cannot reset a passport number the way you reset a password. TPWD offered a year of free Kroll credit monitoring, but the enrollment deadline was September 14, so if you are reading this in October, that window has closed. The freeze advice below has not.
In February, Attorney General Ken Paxton issued civil investigative demands to Blue Cross Blue Shield of Texas and Conduent Business Services over a breach of Conduent’s systems running from October 2024 into January 2025. His office cited roughly four million affected Texans, including Texas Medicaid recipients, and Paxton called it “likely the largest breach in U.S. history.” That characterization is contested. Industry reporting notes that Change Healthcare, at roughly 193 million people, still holds that distinction, and puts the total Texan exposure from Conduent closer to 15.5 million. Either number is enormous, and unlike the TPWD incident, this one involved protected health information.
Smaller filings pile up behind the headlines. The Texas Hearing Institute notified about 30,000 Texans in the spring that names, Social Security numbers, financial information, and medical records were compromised, with the Interlock ransomware group claiming the theft. Under Texas law, any organization that exposes data belonging to 250 or more Texans must report it to the Attorney General within 30 days. That public filing list is worth bookmarking. It is a far better picture of your actual exposure than any national headline.
What it costs, nationally
The FBI’s 2025 Internet Crime Report, published in April, logged 1,008,597 complaints and roughly $20.9 billion in reported losses, a 26 percent jump over the prior year. Victims 60 and older accounted for $7.7 billion of that. The average loss across all victims was $20,699. For the first time, the report broke out AI-facilitated fraud as its own category: about 22,000 complaints and nearly $893 million.
Separately, the FTC reported $3.5 billion lost to imposter scams in 2025, the most-reported fraud category for the ninth year running, with losses up nearly 20 percent.
These are floors, not ceilings. FTC research suggests fewer than one in twenty mass-market fraud victims ever files a federal report.
How stolen data actually reaches your accounts
A breach notice by itself does not drain a bank account. The chain that follows it does.
Your phone number is the weakest link in that chain. In a SIM swap or port-out attack, someone convinces your carrier to move your number to a device they control. Your phone silently drops to “no service,” and every password-reset code sent by text now goes to the attacker. The FCC adopted rules in 2023 requiring carriers to authenticate customers before a SIM change or port-out and to notify you immediately when one is requested. Those rules helped. They did not solve insider bribery at retail stores, and the protections carriers built on top of them are mostly off unless you turn them on.
Text messages are now the primary delivery channel for the initial hook. The FCC’s guidance on smishing is short and worth reading: never click links or call numbers you don’t recognize, don’t reply even to opt out, and verify anything urgent by contacting the company through a number you looked up yourself.
The old tells are gone. Bad grammar and clumsy formatting stopped being reliable indicators around 2024. Voice cloning needs only a few seconds of source audio. If you have spoken on a recorded call, your voice is available to whoever wants it.
The checklist
None of this is novel. All of it works.
Change your passwords and stop reusing them. One unique password per account, generated and stored in a password manager. Reuse is the mechanism that turns a breach at a company you barely remember into a drained checking account somewhere else.
Turn on MFA, and use the right kind. An authenticator app, a hardware security key, or a passkey. Not SMS. Text codes are interceptable by exactly the SIM swap described above. Where a service supports passkeys or a FIDO2 key, take it. Phishing kits running today can capture a session cookie after a successful login, and hardware-bound credentials are the only thing that reliably stops that.
Lock down the carrier account itself. Set a port-out PIN and enable number-transfer protection with your carrier. It lives in account settings and is off by default at most of them. This is the single highest-value ten minutes on this list.
Freeze your credit at all three bureaus. It is free under federal law, does not affect your score, and lasts until you lift it. You must do each one separately, because a freeze at one bureau does not propagate to the others:
- Equifax or 800-685-1111
- Experian or 888-397-3742
- TransUnion or 800-916-8800
The FTC’s overview covers the difference between a freeze and a fraud alert, and confirms what a freeze does and does not do. When you need to apply for credit, lift it temporarily. Parents can freeze a child’s file for free as well, and child identity theft typically goes undetected for years.
A freeze blocks new accounts opened in your name. It does nothing about fraud on accounts you already have. Pair it with transaction alerts on every card and bank account you hold.
Report what happens to you. Fraud goes to ReportFraud.ftc.gov, internet crime to IC3.gov, and identity theft recovery plans come from IdentityTheft.gov. Underreporting is why the official numbers understate the problem, and why enforcement resources go where they do.
If you bought a Texas hunting or fishing license, carried a BCBSTX plan, or sat in a Texas medical office this year, the odds are good that your information is already circulating. You cannot un-breach it. You can make it useless to the person holding it, and October is as good a month as any to spend the two hours.
