txcyber.net — incident / texas

Cyber attack in Texas? Who to call first

Something broke. Here is who to call in Texas, in what order, depending on who you are. Bookmark it, print it and put it in the binder before you need it.

life safety 911 Water, power or medical systems acting wrong? People first. texas government · 24/7 (877) 347-2476 Texas Cyber Command. Agencies, cities, counties, districts and schools: a call meets the 48-hour legal deadline. anyone · 24/7 (888) 282-0870 CISA, the federal cyber defense agency. Also [email protected].

01 / FIRST MOVES

The first hour, whoever you are

  1. 01

    Safety first

    If anyone’s safety is at risk (water, power, medical devices), call 911 and switch affected processes to manual.

  2. 02

    Isolate, don’t erase

    Disconnect affected machines from the network. Do not wipe, reimage or power off unless told to: evidence lives in memory and logs.

  3. 03

    Use a clean channel

    Assume email and chat may be watched. Call people; use a phone not on the affected network.

  4. 04

    Start a log

    Time-stamped notes of what you saw, what you did and who you told. Every legal clock runs from discovery.

  5. 05

    Report

    Use the contacts below for who you are. Reporting early brings help and protects you.

  6. 06

    Don’t pay alone

    Before any ransom talk, involve counsel, your insurer and law enforcement; some payments can violate sanctions.

02 / WHO TO CALL

Who to call, by who you are

Call in the order shown. Report to more than one place if more than one applies.

contact --resident 6 steps

Texas residents

Scammed, hacked, or told your data was in a breach.

  1. Money moving right now? Call your bank or card issuer first, using the number on the back of your card.
  2. FBI IC3 (opens in a new tab) Report online fraud, extortion and account takeovers.
  3. IdentityTheft.gov (opens in a new tab) FTC recovery plan and official identity-theft report.
  4. Freeze your credit (opens in a new tab) Free at all three bureaus: Equifax, Experian, TransUnion.
  5. Local police Ask for a written report; cite Penal Code ch. 33 for computer crimes.
  6. Texas AG breach list (opens in a new tab) Check whether a company that holds your data has reported a breach.
contact --business 5 steps

Businesses & nonprofits

Ransomware, a compromised email account, or customer data exposed.

  1. Your insurer & counsel Call before you pay anyone or wipe anything; many policies require it.
  2. FBI (opens in a new tab) IC3 online, or your field office (Dallas, El Paso, Houston, San Antonio).
  3. CISA 24/7 (opens in a new tab) (888) 282‑0870 · [email protected]
  4. Texas AG within 30 days (opens in a new tab) If 250 or more Texans are affected. People themselves within 60 days.
  5. FTC within 30 days (opens in a new tab) Non-bank financial businesses, 500+ consumers.
contact --gov 5 steps

Cities, counties, districts & schools

Report within 48 hours of discovery. A phone call meets the deadline.

  1. TXCC hotline 24/7 (877) 347‑2476
  2. Local incident form (opens in a new tab) Archer Engage via the Texas Cyber Command. School districts use the same form for Educ. Code §11.175.
  3. Election data? (opens in a new tab) Report to the Texas Secretary of State.
  4. Follow-up in 10 business days (opens in a new tab) Details and root-cause analysis after recovery.
  5. Schools: TEA [email protected]
contact --water 4 steps

Water & wastewater utilities

Anything touching SCADA, PLCs or HMIs: switch to manual operations if you can, then report.

  1. TXCC hotline (public systems) (877) 347‑2476
  2. CISA 24/7 (opens in a new tab) (888) 282‑0870 · [email protected]
  3. WaterISAC (opens in a new tab) Confidential sector report; [email protected].
  4. FBI field office (opens in a new tab) Especially if water operations were affected.
contact --health 3 steps

Healthcare

Patient data or clinical systems affected.

  1. HHS breach portal (opens in a new tab) Individuals within 60 days; HHS within 60 days if 500 or more.
  2. Texas AG within 30 days (opens in a new tab) If 250 or more Texans are affected.
  3. CISA 24/7 (opens in a new tab) (888) 282‑0870 · [email protected]
contact --phish 3 steps

Just a phishing email or text?

Nothing clicked, nothing lost: report it and delete it.

  1. Texas Cyber Command Forward it as an attachment to [email protected] (open to anyone).
  2. FTC (opens in a new tab) ReportFraud.ftc.gov
  3. Scam texts Forward to 7726 (SPAM) on most US carriers.

Legal deadlines for notifying people, the Attorney General and regulators are on the compliance page. Numbers and links checked Nov 10, 2026. Not legal advice.