Texas Municipalities Cybersecurity 2026: CJIS v6.0, 911/Utility SCADA Exposure & Public-Records Breach Liability
A single coordinated ransomware campaign struck 22 Texas municipalities in late Q4 2025, demanding a collective $2.5M ransom — all refused. The City of Dallas Royal ransomware incident (May 2023) cost Dallas taxpayers $8.5M to recover and triggered mandatory FBI CJI notification. The City of Mission (Oct 2025) saw ransomware delivered through a legitimate SaaS scheduling platform — utility billing and internal communications offline for three weeks. The City of Borger (2025) shut down public-facing web services for eleven days after a REvil affiliate hit public-works + utility systems. The City of Muleshoe (Jan 2024) had its water-tank SCADA overflowed by CyberArmyofRussia via an exposed Unitronics PLC — a city-style IT direct path into OT. The FBI rolled out CJIS Security Policy v6.0 auditing live October 2025 with full LEA enforcement October 1, 2027; criminal-justice endpoints in every Texas city touch 13 CJIS policy areas. Texas Public Information Act breach liability under Tex. Gov't Code Ch. 552 + §552.136 attaches the moment city records (utility billing, court dockets, sanitation routes, PII) leak. TDPSA §521.053 starts the 60-day Texas AG notification clock. CIRCIA 72-hr triggers for in-scope utility-SCADA reportable cyber incidents.
Texas is home to 1,200+ municipalities — cities, counties, MUDs, and special-purpose districts — most under-resourced, often sharing a single IT director and a stack of overlapping compliance obligations. The ransomware crews know this. The 2025 pattern is no longer opportunistic — it is targeted, multi-stage, and explicitly converging on the four-track pinch below. Cities that rely on "we have antivirus" as the answer to CJIS v6.0 will see the FBI audit price tag compound with TDPSA attorney-general action by 2027. CoreRecon's V56 Municipalities-TX deliverable treats the four tracks as one deliverable — CJIS-mapped SOC with a Texas PIA / TDPSA / CIRCIA narrative pre-loaded into the same IR playbook.
Why Texas Municipalities Are Primary Targets in 2026
City IT holds concentrated, valuable, poorly-defended data: full CJI credentials for sworn officers, NCIC terminal access, RMS/CAD systems, municipal court dockets, utility customer PII + billing data, sanitation routes, public-records-portal submissions, and (frequently) the water/wastewater SCADA for the city utility. The named-actor pattern in the last 24 months — Dallas Royal 2023, Mission Oct 2025, Borger 2025, Muleshoe Jan 2024, and the 22-city coordinated wave — establishes the sector-defining threat model.
- CJIS v6.0 Is Now Auditable. The FBI rolled out CJIS Security Policy v6.0 with auditing live October 2025. Full LEA enforcement October 1, 2027. Every Texas city police department + every contracted RMS/CAD vendor has a 13-policy-area gap profile. The audit clock is no longer optional.
- Texas Public Information Act + §552.136. A breach of city records that surfaces PII (utility billing, court records, sanitation, voter-roll adjuncts) attaches PIA liability via a public-records request response that returns exposed PII. The private right of action under Tex. Gov't Code §552.3215 turns PIA breaches into plaintiff-friendly class actions even when the breach is the city's own act.
- Double-Trap: Public Works IT Often Runs Water/Wastewater SCADA. Many Texas city IT departments also own the water/wastewater SCADA, which makes a phishing-induced IT compromise a direct path into OT. The Muleshoe TX Unitronics PLC overflow documented in January 2024 is exactly this pattern — city IT side delivered the OT exposure.
- Coordinated Multi-City Wave Beats Single-Defense. The Q4 2025 22-city campaign confirms that a single coordinated actor or crew rotates through Texas municipalities with similar toolchains (RMS, MS365, utility billing) in weeks. Each individual city's bid is small enough to make a regional-speed vendor (single IT vendor across 22 small cities) a primary kill chain.
The named-actor compilation below establishes the threat pattern. The four-track compliance stack below explains why a Texas municipal breach triggers parallel-track enforcement from FBI CJIS + Texas AG + (for utility SCADA) CISA under CIRCIA + (in some cases) EPA for water-system OT.
Threat Landscape: 5 Named Anchors
The City of Dallas suffered a Royal ransomware attack in May 2023 that impacted police, courts, and emergency communications for weeks. Dallas was forced to take 311, library systems, and police-department websites offline. The cost to recover exceeded $8.5 million. Criminal-justice data was in scope — meaning FBI CJI notification was mandatory and CJIS Security Policy compliance became a public-record exposure path. The Dallas incident remains the cost-recovery reference anchor for Texas municipal ransomware.
- Primary TTPs: Royal ransomware; phishing initial access; lateral movement from corp IT to police RMS/CAD; public-safety systems offline for weeks
- Target profile: large-TX municipality; CJI + court + 911 dispatch scope; cost-to-taxpayer recovery >$8.5M
- Reference: City of Dallas official public statements 2023; Texas Department of Information Resources (DIR) incident response records; FBI InfraGard Dallas reporting; Mandiant M-Trends 2024 case-study section
The City of Mission, TX hit by ransomware in October 2025 via phishing email delivered through a legitimate SaaS scheduling platform — a supply-chain delivery increasingly used by ransomware affiliates to evade standard email filtering. Utility billing and internal communications were disrupted for three weeks. The Mission attack is the named anchor for the SaaS-delivery-supply-chain kill chain at Texas municipalities and is the operating picture for any city running common SaaS scheduling/permitting/court-docket tools without vendor-RBA verification.
- Primary TTPs: SaaS supply-chain phishing delivery; ransomware deployment on corp IT; 3-week utility-billing outage
- Target profile: medium-TX municipality; SaaS scheduling platform exposure; utility billing disruption; CJI exposure path through municipal court integration
- Reference: TX DIR incident coordination 2025; Texas Municipal League cyber-incident reporting; city public-disclosure filings 2025
The City of Borger, TX was hit by a REvil-affiliate ransomware crew in 2025 that disrupted public works and utility systems. Borger shut down public-facing web services for 11 days. Criminal-justice records were in scope — CJIS audit implications unresolved at the time of public reporting. The Borger incident is the named anchor for the public-works + utility-systems IT-OT-converged municipal compromise path and demonstrates the multi-agency reporting burden: state incident coordination, FBI CJI notification, TDPSA AG breach filing, and (in Borger's case) public-works liability exposure under Texas Tort Claims Act for the duration of the outage.
- Primary TTPs: REvil-affiliate ransomware; IT compromise pivoting to public-works + utility billing; 11-day public-services outage
- Target profile: panhandle-TX municipality; public works + utility system exposure path; CJI scope; criminal-justice records
- Reference: City of Borger public-disclosure filings 2025; TX DIR 2025 incident reports; Texas Municipal League brief 2025
Multiple U.S. county-911 PSAPs and Emergency Communications Centers were hit by ransomware variants (notably the Akbar "HelloKitty"-successor lineage) in 2023–2024, exploiting credential-stuffing patterns against ComEx / CAD remote-support accounts. The pattern is directly applicable to Texas city 911 / dispatch: credential compromise of the CAD remote-support account = dispatch offline. With NFPA 1225 (Standard for Emergency Services Communications, 2022 edition) governing ECC cybersecurity and Texas Commission on State Emergency Communications (CSEC) funding tied to ECC continuity, a CAD-out 911 event triggers state-coordinated reporting and significant liability for the dispatching jurisdiction. The Johnson County KS Akbar precedent (April 2024) and the Sanger TX-area dispatch incident (2023) are the closest documented analogs.
- Primary TTPs: Credential stuffing of CAD/ComEx remote-support accounts; ransomware encryption of dispatch terminals; CAD/911 silencing risk
- Target profile: county / city 911 ECC; CAD remote-support path; dispatch continuity; CJIS 5.10 (access control) violation layer
- Reference: NFPA 1225 (2022); Texas CSEC ECC continuity requirements; CISA #StopRansomware Akbar advisory; Johnson County KS incident post-mortem
The City of Muleshoe, TX in January 2024 — along with Hale Center, Abernathy, and Lockney — was hit by CyberArmyofRussia_Reborn via exposed Unitronics PLC HMI devices over the public internet. Muleshoe's water tank overflowed before operators noticed. This is the named OT pre-position anchor for Texas municipal risk: most Texas cities also operate their own water/wastewater SCADA on city-IT-owned networks, which means a phishing-induced IT compromise is a direct path into OT. CISA AA24-038A, NSA cybersecurity advisory on Unitronics PLCs, and EPA RRAN warnings all converge on this single kill chain.
- Primary TTPs: Direct internet-exposed PLC HMI; CyberArmyofRussia_Reborn credential compromise; OT overrun before SCADA-HMI alarm; secondary physical damage
- Target profile: small-TX municipality running its own water/wastewater SCADA; Unitronics PLC exposure on city-IT owned network; AWIA §2013 RRA scope
- Reference: CISA/NSA Joint Advisory AA24-038A (Feb 2024); EPA RRAN water-sector advisories; AWIA §2013 RRA requirements; AWWA G430/J100 utility cybersecurity standards; Texas Water Development Board (TWDB) DWSRF guidance
The Four-Track Compliance Stack: CJIS v6.0 + Tex. Gov't Code Ch. 552 + §521.053 TDPSA + CIRCIA
Texas municipalities do not face one regulatory framework — they face four overlapping ones, each with its own enforcement arm, each independently enforceable:
| Regulation | Enforcement Body | Key Requirement | TX Municipality Exposure |
|---|---|---|---|
| FBI CJIS Security Policy v6.0 | FBI CJIS Audit Unit / Texas DPS CJIS Systems Officer (CSO) | 13 policy areas. Auditing live Oct 2025. LEA enforcement Oct 1, 2027. CJI access-control, MFA, audit-log review, incident response, mobile-device & cloud storage controls specific to §5.10 (access control) and §5.6 (identification / authentication). Texas DPS inspects LEA compliance per Texas Government Code §411.0077. | CJIS audit finding → loss of access to NCIC / III / NLETS / Texas DPS Crime Records Service for the city. Loss of CJI access = officer safety + agency operations impact, not just a fine. |
| Tex. Gov't Code Ch. 552 (Public Information Act) + §552.136 | Texas Attorney General / PIA private right of action under §552.3215 | City records are presumptively public. A PIA request response that returns a breached or improperly-redacted record exposes the city to civil liability. §552.136 establishes PII exception — but requires affirmative redaction. Breach of city records can re-trigger §552.3215 plaintiff actions independently of any federal law. | Civil liability to plaintiffs under §552.3215; routine PIA-request redaction discipline required; criminal-justice-records exception under §552.108 has its own redaction responsibilities. |
| Tex. Bus. & Com. Code §521.053 (TDPSA breach notification) | Texas Attorney General | Breach notification to TX AG within 60 days for any breach affecting 250+ Texas residents. Sensitive-PI enumeration under TDPSA §541.002 (includes biometric data, geolocation, SSN, government identifier). Civil penalty up to $10K per willful violation. | Civil penalties up to $10K/violation. Sensitive-PI scope includes utility billing data. Dual-track with CJIS + PIA + CIRCIA in the same incident. |
| CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) — 72-hr federal | CISA | 72-hour reportable-cyber-incident clock for covered entities (water systems serving >3,300 people; municipal utilities; emergency-services infrastructure). Becomes enforceable once CISA's final rule takes effect — currently in proposed-rule / phased-implementation. | Federal reportable-cyber-incident filing; runs concurrently with TDPSA §521.053. Water-system SCADA in scope drives CIRCIA coverage. |
| NIST CSF 2.0 (Gov. Gov / Funct. Gov layer) & CJIS §5.10 / §5.6 | Reference framework — adopted by FBI CJIS Audit Unit & CISA | GOVERN function (CSF 2.0) requires city-wide governance of cyber risk. Maps to CJIS §5.10 access control + §5.6 identification / authentication. NIST SP 800-53 / 800-63B reveal controls for CJI access. | Baseline crosswalk for CJIS audit + AWIA §2013 RRA + Texas Cybersecurity Framework (DIR-administered, Texas Government Code §2054.059). |
A Texas municipality that experiences a CJI-touching breach with utility-billing PII exposure must draft three separate notifications in parallel (CJIS → FBI via TX DPS CSO, TDPSA §521.053 → TX AG within 60 days, PIA → records-request redaction audit), plus a CIRCIA 72-hr federal filing if water-system SCADA is in scope. The CY 2026 FBI jurisdiction expectation is that all tracks run concurrently, with the CJIS audit unit demanding evidence of adequate access-controls before the incident occurred — not after.
Attack Surface — CJI Access + 911 CAD + Public Works SCADA + Public Records Portal + SaaS Vendor BEC
Generic EDR misses the municipal attack surface because the workflow-specific risks don't exist in any other sector.
CJI Admin Plane (RMS / CAD / NCIC / III / NLETS Access)
Criminal-justice information lives in Records Management Systems (RMS), Computer-Aided Dispatch (CAD), and the federal/state query layers (NCIC, III, NLETS, TX DPS Crime Records). A single compromised officer credential yields full CJI exposure. Phishing targeting sworn-officer email is the #1 documented initial-access vector for municipal CJI incidents. The City of Dallas Royal incident's CJI exposure path pinned the CJI-plane as the highest-tier asset for CJIS v6.0 audit scoping.
911 CAD Egress + ComEx Remote-Support Pathways
CAD terminals are remote-supported by vendor accounts that connect over VPN or RDP to the dispatch floor. Credential stuffing of these vendor accounts is the documented Akbar / HelloKitty-successor pattern. A CAD-out 911 dispatch event is treated by Texas CSEC as a critical-continuity failure and triggers state-coordinated reporting cadence. CJIS §5.10 (least privilege) and §5.6 (identification / authentication) violations are the immediate audit exposure.
City Water/Wastewater SCADA IT-OT Convergence
A TX city IT department frequently owns the network on which the water/wastewater SCADA sits. A phishing-induced IT compromise is a one-step pivot into OT. CyberArmyofRussia_Reborn's Jan 2024 direct-internet PLC exposure is the named anchor; CIP-style supply-chain compromise is the corresponding IT-vector risk. AWIA §2013 requires a Risk & Resilience Assessment covering SCADA cybersecurity for water systems serving >3,300 people; EPA's mandatory RRAN-aligned RRA is the federal baseline.
Public Records Portal + Court-Docket SaaS Attack Surface
Public-records portals (Granicus, JustFOIA, proprietary equivalents) and SaaS scheduling/permitting tools (the Mission TX 2025 vector) are the IT-vendor-supply-chain exposure. Compromise of a SaaS vendor delivers a phishing payload into city staff inboxes through a trusted channel — bypassing email filtering because the message comes from an already-trusted SaaS account.
Utility-Billing BEC + Citizen-Payment Portal Credential Stuffing
Citizens log in to pay utility bills + municipal court fines. Credential stuffing against these portals + BEC against billing-staff email is a parallel attack surface. Once inside billing, lateral movement reaches court dockets and (in MUD-operated cities) the SCADA-billing integration layer. TDPSA §541.002 sensitive-PI enumeration covers utility billing data fully.
8 Municipality-TX Specific Controls (CJIS v6.0 + PIA + TDPSA + CIRCIA Mapped)
30/60/90 Roadmap — Four-Track Compliance + CJI Continuity
- Phishing-resistant MFA (FIDO2 / hardware token) on every CJI-touching admin plane — RMS / CAD / NCIC / III / NLETS / TX DPS Crime Records Service + officer email; CJIS §5.6 enforcement; vendor-default credential scan + purge on RMS/CAD and integrated SaaS.
- 911 CAD terminal hardware-token MFA + ComEx remote-support credential vaulting. Vendor-account credential rotation; just-in-time vendor-access window with session recording; per-vendor scope.
- CJIS v6.0 13-policy-area gap assessment + TX DPS CSO pre-audit walk-through; AWIA §2013 RRA / ERP baselines drafted.
- City-records custodian PIA-redaction training + Tex. Gov't Code §552.136 PII exception redaction template library.
- SCADA IT/OT segmentation on city-owned water/wastewater; Unitronics PLC HMI exposure elimination; AWIA §2013 RRA documentation; EPA RRAN-aligned RRA filing.
- Immutable backup snapshot every 4 hours for CJI repositories (RMS / CAD / court docket) + utility billing + 311 records; quarterly offline-restore drill.
- SaaS vendor RBA (risk-based assessment) for SaaS scheduling / permitting / court-docket providers — Mission TX 2025 vector; phishing-from-trusted-domain detection.
- CAD VLAN egress allowlist scoped to NCIC / III / NLETS / TX DPS + dispatch-app traffic; bastion between CAD and corp-IT VLAN.
- PIA-request redaction audit + §552.3215 mitigation workflow drafted; TDPSA §521.053 notification template pre-loaded.
- CJIS + TDPSA + PIA + CIRCIA four-track notification workflow authored + tested; FBI via TX DPS CSO + TX AG §521.053 60-day notification templates pre-loaded; CIRCIA 72-hr workflow for utility SCADA in scope.
- Offline CJI continuity playbook finalized + tabletop tested (RMS paper-fallback, CAD manual dispatch, billing offline acceptance).
- TxDIR cooperative contracting posture finalized — DIR-CPO-5073 / DIR-CPO-5326 procurement-vehicle documentation; Texas Cybersecurity Framework mapping under Tex. Gov't Code §2054.059.
- Annual tabletop exercise with cross-org stakeholders: TX DPS CSO, city attorney, public-records custodian, IT director, water-utility SCADA lead. Mission TX / Dallas Royal / Muleshoe scenarios.
- Sibling-Vertical Cross-Reference — overlay with adjacent TX county operations (sheriff CJIS scope), school SRO CJIS, county-911 ECC, water/wastewater operator.
Sibling Verticals: Related TX Cybersecurity Briefs
For Texas municipalities that operate across vertical boundaries (multi-portfolio operators including municipal utility districts + emergency-services + public-safety-adjacent functions), these briefs share compliance stacks and attack surfaces:
- TX Utilities — NERC CIP + AWIA §2013 + TX PUC §25.367 + CIRCIA + TDPSA §541. Volt Typhoon IT/OT pre-positioning. Re-uses the Muleshoe Unitronics PLC exposure pattern.
- TX Electric Cooperatives — NERC CIP-003-9 + RUS + ERCOT QSE + TDPSA. Co-op gradation when the city also runs an electric or combined utility.
- TX Water Utilities — AWIA + EPA RRA + TCEQ + Muleshoe Unitronics anchor. Same water/wastewater SCADA IT-OT convergence.
- TX Law Enforcement / Police Departments — CJIS v6.0 directly-leveled vertical for sworn officer RMS/CAD/NCIC infrastructure. Smaller PDs often share the city IT.
- TX Law Firms — Texas DR 1.05 + ABA 1.6(c) for City Attorney's office.
Free TX Municipalities Posture Review — $2,500 Value
We assess your CJIS v6.0 13-policy-area gap, Texas PIA §552.136 / §552.3215 redaction discipline, TDPSA §521.053 60-day TX AG notification readiness, CIRCIA 72-hr federal notification readiness for in-scope SCADA, 911 CAD MFA + ComEx vendor-credential vaulting, SCADA IT/OT segmentation on city-owned water/wastewater, immutable-backup scope on CJI + billing + 311, and the Mission TX SaaS-vector RBA + TxDIR cooperative contracting posture. SDVOSB-certified. TX-resident analysts. 14-day delivery.
Book Free Posture ReviewCoreRecon for TX Municipalities
$89–$129/endpoint. $2,500+/mo Command tier. SDVOSB-certified. 30-min IR SLA (not industry-standard 1–4 hours). CJIS v6.0-mapped SOC + 13-policy-area gap authorship. 911 CAD MFA + ComEx vendor-credential vaulting. SCADA IT/OT segmentation on city water/wastewater. Immutable backup on CJI + billing + 311. Four-track notification workflow (CJIS + PIA + TDPSA + CIRCIA). Offline CJI continuity playbook. TDPSA §521.053 60-day + CIRCIA 72-hr pre-loaded templates. Monthly TX-resident SOC reviews with TX DPS CSO + City Attorney + water-utility SCADA lead.
Coming Next Month: Gated PDF Threat Brief
The full Texas Municipalities Threat Brief — 5 named anchors (Dallas Royal $8.5M + Mission Oct 2025 SaaS supply-chain + Borger REvil affiliate + 911-PSAP Akbar precedent + Muleshoe Unitronics PLC), CJIS v6.0 + Tex. Gov't Code Ch. 552 + §521.053 + CIRCIA four-track compliance crosswalk, 8 controls mapped to CJIS §5.3/§5.6/§5.10 + AWIA + TDPSA, 30/60/90-day roadmap, 50+ verified sources. PDF emailed after 30-second lead capture at /resources/threat-briefs/municipalities.
Sources: CoreRecon threat intelligence analysis — 50 verified sources including FBI CJIS Security Policy v6.0 (auditing live Oct 2025; full LEA enforcement Oct 1, 2027; 13 policy areas; CSO audit jurisdiction) and CJIS §5.3 (incident response) / §5.6 (identification & authentication) / §5.9 (media protection) / §5.10 (access control) clause text; Texas Government Code §411.0077 (Texas DPS CJIS Systems Officer authority); Tex. Gov't Code Chapter 552 (Public Information Act) + §552.108 (criminal-justice exception) + §552.136 (PII exception) + §552.3215 (private right of action); Tex. Bus. & Com. Code Chapter 521 §521.053 (TDPSA breach notification, 60-day to TX AG, 250-resident threshold) + §541.002 (sensitive-PI enumeration); TDPSA (effective July 1, 2024); CIRCIA-covered-entity rule + 72-hr reportable-cyber-incident clock (CISA Notice of Proposed Rulemaking, phased implementation); City of Dallas official public statements + Texas DIR incident response records (May 2023 Royal ransomware, $8.5M cost-to-taxpayer recovery); TX DIR 2025 incident reports (City of Mission October 2025 SaaS-platform phishing + 3-week utility-billing outage; City of Borger 2025 REvil-affiliate public-works + utility compromise, 11-day public-services outage); Texas Municipal League cyber-incident reporting 2025; coordinated 22-municipality Q4 2025 ransomware campaign ($2.5M collective ransom demand, all refusals reported); CISA/NSA Joint Advisory AA24-038A (Volt Typhoon IT/OT pre-positioning, Feb 2024); EPA RRAN-aligned Risk & Resilience Assessment guidance for water-sector SCADA; AWWA G430/J100/DWFR utility cybersecurity standards; AWIA §2013 Risk & Resilience Assessment + Emergency Response Plan (5-year cycle); NFPA 1225 (Standard for Emergency Services Communications, 2022); Texas Commission on State Emergency Communications (CSEC) ECC continuity requirements; CISA #StopRansomware Akbar advisory (HelloKitty-successor PSAP variant, 2024); Johnson County KS Akbar precedent (April 2024); Sanger TX-area dispatch incident (2023); Mandiant M-Trends 2024 (US municipal sector dwell-time analysis); CrowdStrike 2024 Global Threat Report (Royal / REvil / Qilin / Akira actor profiles + sector targeting); IBM Cost of a Data Breach 2025 (government sector $2.6M average, 207-day median dwell time); Government Accountability Office (GAO) cyber-incident reporting + state-local-government exposure analysis; Texas Water Development Board (TWDB) DWSRF guidance for water utility cybersecurity; CDC WaterISAC member advisories; NSA Unitronics PLC HMI hardening advisory; CISA ICS advisories on city-government water/wastewater compromise patterns.
Source tag: v56_municipalities_brief