Every business that reports a breach affecting 250 or more Texans must file the report with the Texas Attorney General.
Pick your industry and region below to see what’s actually been reported near you, not just national averages.
Interactive tool: select your industry and Texas region to see how many data breaches were reported there since January 2025, and how that compares statewide.
Curious whether your own systems would hold up? A Security & IT Health Check finds the gaps before they become a filing like the ones above.
Request a Security & IT Health CheckWhat the Data Shows
Between January 2025 and July 2026, 248 Texas-headquartered businesses filed a data breach notification with the Texas Attorney General. That figure covers companies actually based in the state. It doesn’t include the 355 additional filings from national companies that happened to affect Texas residents but are headquartered elsewhere.
Dallas-Fort Worth businesses filed 69 of those reports. Houston businesses filed 65. The remaining 114 came from the rest of Texas, from Austin and San Antonio to smaller cities and rural counties.
The trend line moves in one direction: Five filings in the first half of 2025, climbing to 97 in the second half, then 133 in the first half of 2026. Some of that increase is more incidents. Some of it is stricter enforcement and better awareness of the reporting requirement itself. Either way, breach reporting in Texas isn’t rare, and isn’t limited to a single industry or city.
The Real Cost of a Data Breach
A filing with the Attorney General is only the visible part of a breach. The 2026 IBM Cost of a Data Breach Report puts the global average cost of a breach at $4.99 million, the highest figure the report has recorded and a 12% increase on the year before.[1]
That figure covers detection, containment, notification, lost business, and recovery, not just a ransom demand if there is one.
Breaches involving AI systems cost more. IBM found that AI-related breaches made up roughly a quarter of malicious breaches in 2026 and cost businesses around $1 million more than the average incident.[1] As more Texas businesses adopt AI tools like Microsoft Copilot, the security review that accompanies that adoption matters as much as the productivity gains. Our Microsoft cloud services team builds that review into every Copilot rollout.
A mid-sized Dallas-Fort Worth or Houston business won’t match the global average exactly, but the pattern holds locally, too: recovery costs more and takes longer than most business owners expect before it happens to them. A Security & IT Health Check is designed to catch the gaps that lead to that bill.
Cybersecurity Statistics Texas Business Owners Should Know
Nationally, the 2026 Verizon Data Breach Investigations Report found ransomware involved in 48% of confirmed breaches, up from 44% the year before, and that 96% of ransomware victims are small and mid-sized businesses.[2] The FBI’s Internet Crime Complaint Center recorded 97,912 complaints from Texas in 2025 alone, with reported losses of $678 million.[3]
Those numbers don’t mean every Texas business is a target of a sophisticated attack. Most of the incidents in the tool above trace back to more ordinary causes: a compromised email account, a misconfigured system, a vendor with weak access controls. That’s useful to know, because those causes are fixable with the basics: multi-factor authentication, patched systems, monitored endpoints, and backups that are tested rather than just scheduled. Our cybersecurity services and IT backup and recovery teams handle exactly that groundwork.
Texas Data Breach Notification Requirements
If a Texas business experiences a breach affecting 250 or more Texas residents, state law requires notifying those individuals within 60 days of discovering the breach, and notifying the Texas Attorney General within 30 days.[4] Businesses in regulated industries often face tighter or additional deadlines: HIPAA requires healthcare organizations to notify within 60 days, the FTC Safeguards Rule gives financial institutions 30 days, and federal contractors under DFARS must report a cyber incident within 72 hours.[5][6][7]
Knowing the deadline doesn’t help much if a business doesn’t find out about a breach until weeks after it happened, which is common. Our IT compliance team helps clients in medical IT services, financial services IT support, construction IT services, and manufacturing IT services build the monitoring and documentation that enable fast, accurate notification if the worst happens.
Texas Data Breach and Cybersecurity FAQs
Quick answers to the questions Texas business owners ask most about breach costs, cyber insurance, and notification law. Use the interactive tool above to get the numbers for your own region and industry.
Texas-headquartered businesses filed 248 data breach notifications with the Texas Attorney General between January 2025 and July 2026, according to the state’s public Data Security Breach Reports. Use the tool above to break that down by region and industry.
The 2026 IBM Cost of a Data Breach Report put the global average at $4.99 million, factoring in detection, containment, notification, lost business, and recovery. Actual costs vary by business size, industry, and the speed at which the breach is identified and contained.
Cyber insurance premiums vary significantly based on a business’s size, industry, and existing security controls. Insurers increasingly ask for proof of basics like multi-factor authentication and tested backups before offering coverage, and businesses without them often pay more or get declined. A Security & IT Health Check provides documentation to support a cyber insurance application.
Texas law requires notifying affected individuals within 60 days of discovering a breach. If 250 or more Texas residents are affected, the business must also notify the Texas Attorney General within 30 days. Regulated industries often have additional deadlines under HIPAA, the FTC Safeguards Rule, or DFARS.
In our dataset of Texas-headquartered breach filings, the “other/professional services” category is the largest by volume, followed by healthcare and government/education. That reflects the sheer number of small and mid-sized service businesses in Texas rather than any single industry being uniquely at risk. Use the industry filter above to see the numbers for your own sector.
DFW businesses filed slightly more breach reports than Houston businesses in our dataset (69 versus 65). Still, the difference is small enough that it shouldn’t be read as one metro being meaningfully safer than the other. Company size, industry mix, and reporting behavior all affect the numbers more than geography does.
Want to know where your own business stands, not just the statewide average?
A Security & IT Health Check reviews your systems directly.
Article Sources
- IBM, Cost of a Data Breach Report 2026, July 2026.
- Verizon, 2026 Data Breach Investigations Report.
- FBI Internet Crime Complaint Center (IC3), 2025 Internet Crime Report.
- Texas Business & Commerce Code, Identity Theft Enforcement and Protection Act (breach notification provisions).
- U.S. Department of Health and Human Services, HIPAA Breach Notification Rule.
- Federal Trade Commission, Safeguards Rule.
- U.S. Department of Defense, DFARS cyber incident reporting requirements (252.204-7012).
- Texas Office of the Attorney General, Data Security Breach Reports (texasattorneygeneral.gov).