Compromised Account Downloaded 300,000 Texas Crash Reports

The Texas Department of Transportation reported that a threat actor used a compromised account to access and download close to 300,000 crash reports on 12 May 2025. The records may include names, addresses, driver’s licence numbers and motor insurance policy numbers. TxDOT disabled the account and established an assistance line for affected individuals.

Almost every file in this database concerns data a person handed over: to shop, to be treated, to be insured, to enrol. The transaction was voluntary even where the consequences were not.

A crash report is different. It exists because someone was in a collision. It was compiled by a police officer, not supplied by the individual, and the individual had no opportunity to decline, to choose a different provider, or to withhold a field. There is no relationship to sever afterwards.

The corpus records the same structure for children at 26-0113, for declined loan applicants at 26-0702, and for utility customers at 26-0326. Government-held records are where it is most absolute — the state’s dataset is not one you can leave.

No vulnerability was exploited. Valid credentials were used to perform an action the account was entitled to perform, 300,000 times.

The control that would have caught this is not authentication — authentication succeeded. It is rate limiting and volumetric anomaly detection on bulk retrieval: a query asking why an account that normally pulls a handful of reports has pulled six figures of them.

That control is unglamorous, cheap relative to most of the security estate, and repeatedly absent across this database. It is the same finding as 26-0331 and 26-0609.

Driver’s licence numbers and insurance policy numbers are durable identifiers used for verification by parties who did not issue them. A licence number is difficult to change and functions as a proof of identity across banking, employment and rental screening.