Texas law requires reasonable procedures to protect sensitive personal information, notice within 60 days of a breach, and a report to the Attorney General within 30 days when 250 or more Texans are affected. DarkThreat helps Texas teams find breached and leaked credentials tied to their domain.
Your attack surface is everything an outsider can reach. Leaked logins are one of the easiest parts of it to use, because they need no exploit at all.
Work email and password pairs from third-party breaches that could open remote access, email or cloud apps.
VPN, remote desktop and cloud console credentials, which give an attacker a way in without malware.
Accounts held by suppliers, integrators and contractors that connect to your systems or hold your data.
Read more on detecting leaked admin credentials and spotting supply chain attacks early.
Texas breach duties turn on this definition in the Identity Theft Enforcement and Protection Act, Business & Commerce Code Chapter 521.
A first name or initial and last name with a Social Security number, driver’s license number or other government-issued ID number.
A name with an account, credit or debit card number and any code or password that would permit access to the financial account.
Information that identifies a person and relates to their physical or mental health, the health care they receive, or payment for it.
For the name-based categories, the law applies when the name and the items are not encrypted. Publicly available information lawfully made available by a government is excluded. Unlike some states, the Texas definition does not list an online username and password on their own.
Section 521.052 requires a business to implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect sensitive personal information it collects or maintains in the regular course of business from unlawful use or disclosure.
It also requires a business to destroy customer records with sensitive personal information that it will not keep, by shredding, erasing or otherwise making the information unreadable.
The section does not apply to financial institutions as defined by federal law, which follow their own rules. It does include nonprofit athletic and sports associations.
The law does not list specific controls or name dark web monitoring. “Corrective action” is the useful phrase: when leaked credentials show a way in, resetting them is the kind of fix a reasonable program makes. Many teams organize this work with the NIST Cybersecurity Framework.
Section 521.053 applies to a person who conducts business in Texas and owns or licenses computerized data with sensitive personal information. A dark web finding is not automatically a breach, but it is a signal your legal and incident response teams will want to assess.
A breach of system security is unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of sensitive personal information. Encrypted data counts if the person accessing it has the decryption key.
A business that owns or licenses the data notifies affected individuals. A business that only maintains data for another must notify the owner or license holder immediately after discovering the breach.
Notice is due without unreasonable delay and no later than the 60th day after you determine the breach occurred. Delay is allowed at a law enforcement request, or as needed to determine the scope and restore the system.
Report as soon as practicable and no later than the 30th day after you determine the breach occurred, using the electronic form on the Attorney General’s website.
If you notify more than 10,000 people at one time, you must also tell each nationwide consumer reporting agency the timing, distribution and content of the notices, without unreasonable delay.
If an affected person lives in another state that has its own breach notice law, the notice may follow that state's law or the Texas rule. Notice can be written or electronic, and substitute notice is allowed in limited cases.
For the first practical steps, see what to do in the first 48 hours of a data breach.
The 30-day deadline took effect on September 1, 2023, under Senate Bill 768. Before that, the limit was 60 days.
The Attorney General posts a public listing of the reports it receives. Its website also notes that a completed report is potentially an open record.
Violations of Chapter 521 carry a civil penalty of $2,000 to $50,000 per violation. Failing to take reasonable action to notify individuals adds up to $100 per individual per day, capped at $250,000 for a single breach.
The Texas Data Privacy and Security Act took effect on July 1, 2024. According to the Texas Attorney General, it applies to companies that conduct business in Texas or produce a product or service consumed by Texas residents, and that process consumers' personal data.
Small businesses as defined by the federal Small Business Administration are generally exempt, except that they need consent before selling sensitive data.
Personal data under the Act is much broader than sensitive personal information under Chapter 521. It covers any information linked or reasonably linkable to an identified or identifiable individual.
Operators rely on remote access for field sites and on many contractors. Leaked remote access and vendor logins are a direct path in. Customer billing records with account numbers can also be sensitive personal information. See energy and utilities.
Information about a person's health, care or payment for care is sensitive personal information under Chapter 521. HIPAA-covered entities are exempt from the TDPSA, but Chapter 521 contains no similar exemption for them. See healthcare, HIPAA and healthcare data leaks.
Cloud services that process Texas state agency data go through TX-RAMP, the Department of Information Resources program for security assessment, certification and continuous monitoring. Federal contractors also face federal rules, covered on our Washington DC threat intelligence page. See government.
For tech companies and startups: lookalike domains, phishing kits and leaked credentials, plus Texas' online impersonation law.
Read the Austin pageDarkThreat helps with the detection side of your program. It monitors for breached and leaked credentials tied to your domain and sends email notifications when something is found.
Those alerts support your corrective action and your legal review under Texas law. They do not replace either, and no tool makes an organization compliant with Texas law.
You can start with a 7-day free trial, and no credit card is required. Paid plans start from $288 per month. See pricing for plan details.
Plans start at $288/mo. A 7-day free trial is available, and no credit card is required to start. Tell us which domains you need watched.
Business & Commerce Code 521.053 requires notice without unreasonable delay and no later than the 60th day after the business determines the breach occurred, with exceptions for law enforcement requests and the time needed to determine scope and restore the system.
If a breach involves at least 250 Texas residents, the business must notify the Attorney General as soon as practicable and no later than the 30th day after it determines the breach occurred, using the Attorney General’s electronic form.
No. According to the Texas Attorney General, the Act does not provide a private right of action. The Attorney General has exclusive authority to enforce it, after giving a written notice and a 30-day period to cure.
No tool can do that. DarkThreat supports the detection side of your security program by helping you find breached and leaked credentials tied to your domain. Notification decisions and legal compliance stay with your leadership and counsel.
DarkThreat offers a 7-day free trial with no credit card required. Paid plans start from $288 per month. See the pricing page for plan details.
This page summarizes public law and official government guidance for general information. It is not legal advice.
Explore DarkThreat coverage across additional US cities and states.
Join 500+ security teams monitoring 2M+ dark web sources daily. Schedule a demo to see the platform in action.
Setup in under 5 minutes · No agents or software required · Cancel anytime
