Texas Threat Intelligence

What We're Seeing
In the Field

Threat briefs, incident analysis, and attacker TTPs from CoreRecon's Texas SOC. Ungated. Updated with every major wave.

Filter: 42 CFR Part 2 ALF ALPHV AWIA Accounting Agriculture Auto Dealers BEC BH Privacy Banking Behavioral Health Breach CDK CISA CJIS CMMC Cloud Community Banking Compliance Construction Credit Unions DEA CSOS DSO Defense Contractors Dental EPA ERCOT Electric Cooperatives Energy FDIC FERPA FFIEC FTC Safeguards Finance Financial Food & Ag GLBA HIPAA Healthcare Higher Education IOLTA IRS WISP Law Firms Legal Manufacturing MatrixCare Medicaid Mortgage Finance Muleshoe Municipalities NCUA NERC CIP NIST CSF NMLS OT/ICS OT/SCADA Oil & Gas PMS Pharmacy Professional Services Qilin RUS Ransomware RedSail Rhysida SAMHSA SaaS & Tech Sandworm Senior Living Supply Chain TCEQ TDPSA TSBDE TSBP TX HB 300 TX HSC 247 Texas Threat Intelligence Veterinary Volt Typhoon Water Utilities Wire Fraud All
Anchor Report
Texas Threat Intelligence · All Verticals · June 2026
State of Texas Cyber Threats 2026: What 8 Verticals Are Telling Us
3,200 words. 70 citations. Three cross-vertical attack patterns, 8 sector summaries, 5-framework compliance overlay, and what 30-minute response actually means per vertical. The anchor intelligence piece for Texas security posture in 2026.
3,200
words, 70 citations
8
Texas verticals covered
207 days
avg dwell time before TX detection
Read the Full Report →
Tags: Threat Intelligence · Texas · Ransomware · Supply Chain · BEC
Behavioral Health July 2026
Texas Behavioral Health & Mental Health Clinic Cybersecurity: The 42 CFR Part 2 + HIPAA Gap You're Inheriting in 2026
TX BH & mental health clinics hold psychiatric records, SUD histories, MAT EPCS prescribing logs, crisis-line recordings, and consent-management audit trails. 42 CFR Part 2 federal criminal liability stacks on HIPAA civil penalties. 6 named incidents (Behavioral Health Group TX SUD exposure, Deer Oaks $225K, Acuity Brands LockBit, Lifepoint, Ardent, CHS). TX HB 300, TX HSC Ch. 611, TDPSA §541.062, FTC HBNR 16 CFR §318, SAMHSA NIMDAT concurrent clocks. BH-EHR attack surface: Credible / Kipu / myEvolv / Netsmart / Epic Behavioral Health. $89–$129/endpoint, 30-min IR SLA, SDVOSB, TX-resident SOC.
$9.8M avg breach cost
BH sub-sector — IBM CODB 2025, highest of any healthcare sub-sector
Read Brief →
HealthcareHIPAA
Community Banks July 2026
Texas Community Banks Face a Cybersecurity Reckoning — Here’s How to Respond
With the FFIEC CAT retired, GLBA 2023 amendments in force, and TDPSA active, TX community banks face a compounding compliance burden with no SOC to manage it. Here’s what you need to do now.
86,067 Texans
affected by Texas Capital Bank breach (May 2026) — class action filed July 2026
Read Brief →
Community BankingFFIEC
Dental Practices June 2026
Texas Dental Practice Ransomware: Why Your Patients’ Data Is the Payday in 2026
TX dental practices face compounding ransomware risk in 2026. Named incidents (Henry Schein, Change Healthcare, Pecan Tree Dental Grand Prairie TX), PMS attack surface (Dentrix, Eaglesoft, Open Dental), HIPAA + TSBDE + TX HB 300 triple exposure, and what 30-min SOC response buys your practice.
8.9M records
MCNA Dental 2023 — TX Medicaid/CHIP dental administrator
Read Brief →
DentalRansomware
Electric Co-ops June 2026
Texas Electric Cooperative Ransomware: Why Co-ops Are in the 2026 Crosshairs
TX electric co-ops face compounding threat from Volt Typhoon, Qilin, and Sandworm targeting OT/IT convergence gaps. Named incidents, NERC CIP triple-stack, and 5-step posture assessment.
Karnes EC + San Bernard EC
Qilin ransomware — member PII confirmed exfiltrated from both TX co-ops
Read Brief →
Electric CooperativesOT/SCADA
Senior Living June 2026
Texas Senior Living Ransomware 2026: The 207-Day Gap That Costs Resident PHI
TX senior living & assisted living facilities face a 207-day average detection gap. Learn why ransomware gangs target LTC operators, the TX compliance stack, and how CoreRecon closes the gap.
207-day dwell
avg before a TX ALF detects a breach — 6+ months of resident PHI exposure
Read Brief →
HealthcareHIPAA
Mortgage Brokers June 2026
Texas Mortgage Brokers & Lenders Ransomware Threat 2026: loanDepot, Mr. Cooper, and the GLBA Safeguards Gap
Six named incidents — loanDepot $26M, Mr. Cooper $25M, Fairway $12-17M, Academy, FNF/LoanCare $5.9M, First American Title. ALPHV/BlackCat and LockBit 3.0 targeting TX mortgage brokers. GLBA Safeguards Rule §314.4 nine-element enforcement is live. NMLS bond exposure. 30-min wire fraud SLA math. 62 sources.
$71M+
documented losses across 6 verified mortgage sector incidents — loanDepot, Mr. Cooper, Fairway, Academy, FNF/LoanCare, First American
Read Brief →
Mortgage FinanceGLBA
Water Utilities June 2026
TX Water Utilities Ransomware: Muleshoe Attack, SCADA Exposure & AWIA Compliance
Russian actors hit Muleshoe, TX in Jan 2024. Here is what Texas water districts need to know about AWIA compliance, SCADA exposure, and ransomware defense.
Jan 2024
CyberArmyofRussia_Reborn — Russian GRU-linked group caused Muleshoe TX water tank overflow, 30–45 min
Read Brief →
Water UtilitiesOT/SCADA
Independent Pharmacies June 2026
TX Independent Pharmacies Under Ransomware Fire: The 2026 Threat Brief
Texas independent pharmacies face triple-jeopardy HIPAA + TSBP + DEA enforcement. 2026 threat brief covers named incidents (Change Healthcare 100M records, PharMerica 5.8M, AAP/Embargo 2,000+ pharmacies), regulatory stack, vendor consolidation risk, and 90-day remediation roadmap. CoreRecon SOC at $89–$129/endpoint.
100M records
Change Healthcare breach — 3-week pharmacy outage, TX pharmacies dispensing at personal risk
Read Brief →
HealthcarePharmacy
Dental Practices June 2026
Texas Dental Practice Ransomware & HIPAA Breaches: 2026 Threat Outlook
MCNA 8.9M records. Henry Schein BlackCat 1M+. Ransomware dwell time 207 days. HIPAA + TDPSA + TX HB 300 + TSBDE dual-enforcement. Dentrix/Eaglesoft/Open Dental/Curve attack surface. 8 controls, 30/60/90 roadmap. CoreRecon SOC at $89–$129/endpoint.
8.9M records
MCNA Dental 2023 — TX Medicaid/CHIP dental administrator
Read Brief →
DentalRansomware
Water Utilities June 2026
Texas Water Utility Ransomware: The Incidents, Attack Surface, and Compliance Guide
CyberArmyofRussia compromised 4 TX Panhandle water utilities in Jan 2024 — Muleshoe tank overflowed via exposed VNC/Unitronics PLCs. AWIA Section 2013 mandates SCADA RRA. EPA RY2, TCEQ, CISA CPGs, NIST CSF 2.0 all in scope. 6 named threat actors, OT/IT attack surface, 8 water-utility-specific controls. CoreRecon OT-aware SOC at $89–$129/endpoint.
Jan 2024
CyberArmyofRussia HMI compromise at 4 TX Panhandle water utilities — Muleshoe tank overflowed
Read Brief →
Water UtilitiesOT/SCADA
Water Utilities June 2026
Texas Water Utilities Cyber Threat Brief 2026
CyberArmyofRussia hit Muleshoe, Hale Center, Abernathy, and Lockney in January 2024 — HMI via VNC, tank overflow before operators noticed. AWIA Section 2013 mandates RRA including SCADA cybersecurity. EPA RY2, CISA CPGs, TCEQ, and NIST CSF 2.0 all in scope. 6 threat actors, OT/IT attack surface, 8 water-utility-specific controls. CoreRecon OT-aware SOC at $89–$129/endpoint.
Jan 2024
CyberArmyofRussia HMI compromise at 4 TX Panhandle water utilities — Muleshoe tank overflowed
Read Brief →
Water UtilitiesOT/SCADA
Senior Living June 2026
Texas Senior Living & Assisted Living Communities Cyber Threat Brief 2026
1,200+ TX ALFs in 4-layer regulatory stack, no dedicated SOC, BYOD tablets without MDM, legacy EHRs — BlackCat/ALPHV actively targeting. Acuity Health 2.5M+ records. HIPAA + TX HSC Chapter 247 + Medicaid + TDPSA. 8 ALF-specific controls. 48 verified sources. CoreRecon SOC at $89–$129/endpoint.
2.5M+ records
Acuity Health 2024 — TX Medicaid ALF provider, resident health records exposed
Read Brief →
HealthcareHIPAA
Dental Practices June 2026
Texas Dental Practices & DSOs Cyber Threat Brief 2026
MCNA Dental: 8.9M records stolen (TX Medicaid/CHIP administrator). Professional Dental Alliance: 170K+ records. Dental records sell for $250–$1,000/file on dark web — 10x credit cards. HIPAA Security Rule + TDPSA dual-track. 3 named incidents, 5 attack vectors, 5 controls. CoreRecon SOC at $89–$129/endpoint.
8.9M records
MCNA Dental 2023 breach — TX Medicaid/CHIP dental administrator
Read Brief →
HealthcareHIPAA
Veterinary Hospitals June 2026
Texas Veterinary Hospitals Cyber Threat Brief 2026
NVA 2024 breach: 1.1M+ pet records exposed. BlackCat, LockBit, Rhysida targeting TX veterinary hospitals. AVImark/Hippo Manager credential compromise. HIPAA Security Rule + TX HB 300 dual-track exposure. 6 named incidents, 8 controls, 30/60/90 roadmap. CoreRecon SOC at $89–$129/endpoint.
1.1M+ pet records
NVA 2024 breach — largest veterinary sector breach in US history
Read Brief →
HealthcareHIPAA
Law Firms June 2026
Texas Law Firms Cyber Threat Brief 2026
Mossing & Navarre Toledo ransomware. Bryan Cave Leighton Paisner CCG breach. State Bar of TX hit by INC Ransom (January 2025). Orrick $8M settlement. TX Bar Rule 5.03, ABA Formal Opinion 498, TDPSA (Jul 2024), IRS Pub 4557. IOLTA wire fraud kill chain. 5 controls. 35+ verified sources.
45
ransomware attacks on law firms in 2024 — record high (Black Fog 2024)
Read Brief →
LegalLaw Firms
Behavioral Health June 2026
Texas Behavioral Health Clinics Cyber Threat Brief 2026
6 verified TX behavioral health incidents. 42 CFR Part 2 + HIPAA double-jeopardy. BH organizations average $9.8M breach cost. BlackCat, Qilin, and Rhysida targeting psychiatric records and substance use data. TX HB 300 + NIMDAT + SAMHSA compliance. 8 controls, 30/60/90 roadmap. CoreRecon BH-focused SOC at $89–$129/endpoint.
$9.8M avg breach cost
BH organizations — IBM CODB 2025, highest of any healthcare sub-sector
Read Brief →
HealthcareHIPAA
Construction June 2026
Texas Construction & General Contractors Cyber Threat Brief 2026
Williams Brothers Construction hit by Akira (Feb 2026). Texas GC lost $2.5M in BEC wire fraud. Bouygues Construction €10M Maze ransom. CMMC 2.0 Phase 2 enforcement begins Nov 2026. BEC wire fraud kill chain. 8 controls for TX GCs. 32 verified sources.
$2.5M
TX GC BEC wire fraud loss — draw payment rerouted, $1.7M unrecovered
Read Brief →
ConstructionBEC
Accounting & CPA June 2026
Texas Accounting & CPA Firms Cyber Threat Brief 2026
Whitley Penn (Oct 2023), Lane Gorman Trubitt (Jan 2024), BST & Co. HIPAA action, Orrick $8M settlement. MOVEit exploitation targeting professional services. IRS WISP compliance walkthrough. FTC Safeguards Rule QI requirements. TDPSA + GLBA + SOC 2 overlap. 38 verified sources.
$8M
Orrick class action settlement — new professional services liability standard
Read Brief →
FinanceProfessional Services
Oil & Gas June 2026
Texas Oil & Gas Cyber Threat Brief 2026
935% ransomware surge YoY. Halliburton $35M loss (SEC 8-K). Colonial Pipeline DarkSide attack. Newpark Resources, ENGlobal. Volt Typhoon OT pre-positioning. TSA SD-02F, SEC Item 1.05, CMMC 2.0, TDPSA regulatory crosswalk. 59 verified sources.
$35M loss
Halliburton — RansomHub ransomware, Aug 2024 (SEC-confirmed)
Read Brief →
Oil & GasOT/ICS
Agriculture June 2026
Texas Agriculture Under Cyber Siege: 2026 Threat Brief
Three major food sector attacks. 118% ransomware spike. Schreiber $2.5M ransom, JBS $11M paid, Dole $10.5M direct costs. TDPSA + USDA + FDA FSMA 204 + APHIS regulatory stack. 8 OT/ICS controls for TX farmers, processors, and co-ops.
118% spike
Q4 2024 food/ag ransomware surge vs Q4 2023
Read Brief →
AgricultureOT/ICS
Banking June 2026
Texas Community Banks Cyber Threat Brief 2026
Heartland Tri-State Bank collapsed ($47.1M CEO fraud). Evolve Bank lost $185M to LockBit. Core-provider supply chain risk. FFIEC CAT maturity walk-through. GLBA 16 CFR 314 Safeguards checklist. FDIC 36-hr notification guide. BEC wire-fraud benchmarks from FBI IC3 2024. 35+ verified sources.
$47.1M fraud
Heartland Tri-State Bank CEO — social engineering + wire authority = bank failure
Read Brief →
BankingGLBA
Auto Dealers June 2026
Texas Auto Dealers Under Cyber Siege: 2026 Threat Brief
CDK Global paid $25M ransom. 15,000 dealers offline 3 weeks. 700Credit 5.6M consumers exposed. Motility/Reynolds 766K records. FTC Safeguards Rule 8-requirement checklist. 8 DMS dealer controls. 40+ verified sources.
$25M ransom
CDK paid — Austin-based DMS vendor (Jun 2024)
Read Brief →
Auto DealersCDK
Law Firms June 2026
Why Texas Law Firms Are Under Siege: The 2026 Cybersecurity Reality
Houston attorney loses $2.4M in a single wire. FBI IC3 $2.77B BEC losses. Orrick $8M, HPMB $200K NY AG fine, Gunster $8.5M settlements. ABA Rule 1.6(c) + TX DR 1.05 + TX SB 2610 safe harbor. 12-step action checklist.
$2.4M wire loss
Houston firm — BEC kill zone at closing
Read Brief →
LegalBEC
Higher Education June 2026
Texas Higher Education Cyber Threat Brief 2026
1,000+ U.S. higher education institutions hit in 2024. TTUHSC 1.4M records. 207-day dwell analysis. 8-framework compliance crosswalk: FERPA, GLBA Safeguards, HIPAA, CMMC L2, TX SB 820, TX HB 300, PCI DSS, TX DIR. 35 verified sources. 12-item action plan.
1,000+ institutions
hit by ransomware or breach in 2024
Read Brief →
Higher EducationFERPA
Manufacturing June 2026
Texas Manufacturing Cyber Threat Brief 2026
Manufacturing is the most-attacked TX sector in 2026. IBM X-Force confirms supply-chain dominance. Brunswick Corp. $85M precedent. OT/IT convergence gaps and NIST CSF 2.0 implementation roadmap.
#1 attacked
sector in Texas per IBM X-Force 2026
Read Brief →
ManufacturingOT/ICS
Municipalities June 2026
Texas Municipalities Cyber Threat Brief 2026
22 Texas municipalities hit by coordinated ransomware in Q4 2025. FBI CJIS v6.0 auditing is live. 13 CJIS policy area gaps, threat actor profiles, and 30/60/90 hardening roadmap.
22 municipalities
hit by coordinated Q4 2025 ransomware wave
Read Brief →
MunicipalitiesCJIS
SaaS & Tech June 2026
Texas Tech Sector Cyber Threat Brief 2026
SaaS platform supply-chain attacks, API credential theft, and cloud misconfiguration targeting Texas tech companies. SOC 2 Type II gaps, startup IP exfiltration, and DevSecOps hardening roadmap.
SOC 2 Type II
compliance gap most common in TX tech incidents
Read Brief →
SaaS & TechSupply Chain
Defense Contractors June 2026
Texas Defense Contractor Cyber Threat Brief 2026
Volt Typhoon supply-chain pre-positioning in Texas DIB. CMMC Level 2 enforcement Nov 2026. 4 confirmed incidents, CUI exfiltration vectors, and ITAR exposure analysis.
CMMC Nov 2026
Level 2 enforcement deadline for TX DIB
Read Brief →
Defense ContractorsCMMC
Law Firms June 2026
Texas Law Firms Cyber Threat Brief 2026
1.2M+ client records exposed. Business email compromise at closing, attorney credential theft, and client trust account fraud. Texas State Bar Ethics Opinion 712 compliance roadmap.
1.2M+ records
client records exposed in TX legal sector incidents
Read Brief →
Law FirmsBEC
Credit Unions June 2026
Texas Credit Union Cyber Threat Brief 2026
FIN7, Scattered Spider, and LockBit 3.0 targeting Texas credit unions. NCUA CAT compliance gaps. Core banking system attacks and ACH fraud vectors. 280K+ member records at risk.
280K+ members
at risk across TX credit union incidents
Read Brief →
Credit UnionsNCUA
Healthcare June 2026
Texas Healthcare Cyber Threat Brief 2026
12 verified TX healthcare incidents. 207-day average dwell time. $9.8M average breach cost. BlackCat, Qilin, Rhysida, INC Ransom profiles. HIPAA + TX HB 300 double-jeopardy regulatory exposure.
207-day dwell time
avg attacker persistence before detection
Read Brief →
HealthcareHIPAA
Interactive Tools — Free
Healthcare · HIPAA
HIPAA Readiness Quiz
18 questions. All 18 Security Rule standards. Know your OCR gaps before enforcement — instant scored results.
Take the Quiz →
All Verticals · IBM 2024
Breach Cost Calculator
Industry, endpoints, records. Get your IBM 2024 breach cost range + TX penalty exposure in 30 seconds.
Calculate My Risk →
All Verticals · BLS 2025
vCISO ROI Calculator
vCISO vs. in-house CISO. 3-year TCO with 1.3x benefits multiplier + CoreRecon tier selector.
Calculate vCISO ROI →
Defense · CMMC
CMMC Readiness Quiz
14 questions. All CMMC L2 domains. Know your SPRS gaps before DoD enforcement — Nov 2026 deadline.
Take the Quiz →
🛠 Try All 7 Tools — Free → All Guides & Resources →
Get Every Brief Delivered
New threat briefs as major Texas incident waves hit. No marketing. Just intel.
Free Security Posture Assessment View SOC Pricing