Millions of Texas Driver's Licenses Stolen Through WordPress Security Flaw

A Major Security Gap Put Millions at Risk

Texas residents are facing a serious privacy crisis. Attackers have successfully stolen driver's license information belonging to more than 3 million people in the state. The culprit? A security weakness in Gravity SMTP, a widely-used tool that helps website owners send automated emails through WordPress—the platform that powers nearly half of all websites online.

The vulnerability works like an unlocked back door to a house. Even though the tool was designed to be secure, a flaw in how it was built left sensitive data exposed to anyone who knew where to look. Hackers exploited this weakness to access personal details that Texans had submitted through online forms—information like names, dates of birth, and driver's license numbers.

What makes this particularly concerning is scale: this same vulnerable plugin is currently running on approximately 100,000 websites worldwide, meaning the potential for similar breaches extends far beyond Texas.

What This Means

This breach demonstrates a critical reality of modern life: the security of your personal data often depends on tools you've never heard of. When you submit information to a government website or business, that data passes through multiple software systems. If even one component has a security flaw, everything falls at risk.

The Texas incident shows that government agencies—which we expect to protect our information carefully—can still fall victim to preventable attacks. This vulnerability wasn't a sophisticated, cutting-edge hack; it was an information disclosure flaw that competent security experts should have caught before the tool was deployed.

The real danger: Your stolen driver's license information can be used to open bank accounts, apply for credit, or create fake IDs. This type of identity theft can take months or years to fully resolve.

Why You Should Care

If you're a Texas resident, your state ID details are now in criminal hands. Even if you haven't directly used the Texas government website, your information may have been stored there from previous license renewals or applications.

Beyond Texas, this incident highlights a broader lesson: your security depends on technology choices made by people you'll never meet. Website owners chose this plugin because it seemed convenient. That choice now affects millions of innocent people.

For businesses and government agencies nationwide, this is a wake-up call about the hidden risks of popular software tools. Just because something is widely used doesn't mean it's been thoroughly tested for security problems.

What You Can Do

• Monitor your credit reports. Request free reports from all three major credit bureaus at annualcreditreport.com and check for suspicious accounts.
• Place a fraud alert. Contact one credit bureau to add a flag to your account—they'll notify the others. This makes it harder for criminals to open accounts in your name.
• Consider a credit freeze. This more aggressive option locks your credit, preventing anyone (including you) from accessing it without your permission.
• Watch for phishing emails. Criminals sometimes follow up breaches by pretending to be legitimate companies. Never click links in unexpected emails.
• Change passwords. If you've used the same password elsewhere, update it on those sites immediately.

Looking Forward

The Texas government and the plugin developer face pressure to fix this vulnerability immediately and notify all affected users properly. Regular security testing—finding and fixing problems before attackers do—needs to become standard practice rather than an afterthought.

This breach reminds us that protecting our digital lives requires constant vigilance from both the organizations holding our data and from ourselves.