Update: A software misconfiguration in the Texas Integrated Grant Reporting system allowed applicants to see the private details of other users. The flaw, first reported by a user in late July, exposed names, addresses, Social Security numbers, bank account information, and medical records. Those affected were disaster victims who had applied for assistance for home repairs, rebuilding, or buyouts between 2015 and 2024.
A GLO spokesperson admitted the agency is unsure when the fault first began or how long personal details were exposed, but confirmed the flaw was fixed as soon as it was detected. The matter was logged last month on the Texas Attorney General’s public list of data security breaches.
In a statement, Land Commissioner Dawn Buckingham said the office is “firmly committed to protecting Texans’ personal information as they recover from natural disasters.” She noted that the IT security team worked immediately to contain the issue and has since moved to strengthen the system, including tighter access controls, improved monitoring, and stricter internal reviews.
Why it matters: This breach highlights the serious risks associated with government-managed systems that hold sensitive citizen data, particularly for vulnerable groups such as disaster victims. The exposure of financial and medical information creates a high risk of identity theft and targeted fraud. Cybersecurity expert John Dickson observed that Texas agencies “continue to fall victim to entry-level cyber attacks,” suggesting basic security hygiene is still lacking.
The incident also marks at least the third major lapse involving Texas state systems in the past year. In September 2024, hackers stole the details of 1.4 million people from Texas Tech’s Health Science Centre, while earlier this year 423,000 residents had their information compromised through the Department of Transportation’s crash records database.
This latest breach reinforces the need for stronger safeguards and continuous monitoring of public-facing government applications. It also underscores that devastating consequences can arise not just from sophisticated ransomware attacks, but from simple software flaws left unchecked.