Carnival Corporation confirmed this year that a bad actor used social engineering to deceive a single employee into granting access to part of its IT systems. No malware, no exploit. Nearly 6 million people were affected worldwide; more than 800,000 of them are Texans.
It isn't an isolated case. Texas Parks & Wildlife's breach ran through a third-party vendor's licensing system. PowerSchool — now facing an active lawsuit from Texas Attorney General Ken Paxton — lost the personal and medical data of over 880,000 Texas schoolchildren and teachers via a compromised subcontractor account, with no multi-factor authentication in place.
This guide works through five themes that consistently determine how badly this pattern plays out when it reaches a US organisation — plus what Texas's specific rulebook means once it does.
Three Texas Breaches, One Pattern
Strip the branding out of Carnival, PowerSchool and Texas Parks & Wildlife, and the anatomy is nearly identical: Carnival — a bad actor used social engineering to deceive one employee into granting IT access; nearly 6 million affected, 800,000+ Texans. PowerSchool — a hacker exploited a subcontractor's account to gain administrative access, transferred unencrypted data to a foreign server, then demanded a $2.85 million ransom; 880,000+ Texas schoolchildren and teachers affected, including Social Security numbers and medical/special-education records, with no MFA and inadequate encryption in place despite marketing "state-of-the-art protections." Texas Parks & Wildlife — an unauthorized actor reached customer data through a vendor managing the agency's licensing system.
Chapter 521 of the Texas Business & Commerce Code requires notice to affected individuals within 60 days of discovering a breach, and notice to the Texas Attorney General within 30 days if 250+ Texas residents are affected. The Texas Data Privacy and Security Act (TDPSA), in force since July 2024, sets a "reasonable security" standard under Chapter 541, with penalties up to $7,500 per violation. AG Paxton's office is demonstrably willing to litigate — the PowerSchool suit alleges violations of the Texas Deceptive Trade Practices Act and the Identity Theft Enforcement and Protection Act.
Theme One — Identity & Access
PowerSchool's breach ran through a subcontractor's account with no MFA. Carnival's ran through a deceived employee. Ask honestly: are your vendor, subcontractor and support accounts held to the same identity standard as your core systems? For most US organisations we assess, the answer is no.
Audit every vendor, subcontractor and employee account that can reach bulk personal data, and confirm each requires phishing-resistant authentication.
Apply least-privilege and session limits to vendor/subcontractor access specifically.
Put vendor identity requirements in writing as part of every contract — and verify them, rather than trusting a vendor's marketing claims.
Theme Two — Data Protection
PowerSchool lacked proper encryption on data a compromised subcontractor account could reach — the single gap that let SSNs and medical records leave for a foreign server. If personal data is tokenised at the data layer, an account can still be compromised, but what leaves is meaningless without a key the attacker doesn't have.
Identify which systems hold SSNs, medical or other high-sensitivity data readable in plain text — vendor-facing systems are the usual blind spot.
Prioritise tokenisation for the highest-sensitivity data first — exactly the category TDPSA Chapter 541's "reasonable security" standard targets.
Theme Three — Monitoring & Detection
PowerSchool's attacker transferred unencrypted data to a foreign server before demanding a $2.85 million ransom. Most of these cases are discovered well after the fact, not through real-time detection.
If a vendor or employee account suddenly transferred a large volume of SSNs or medical records externally, would you see it in minutes — or find out from a ransom note?
Instrument behavioural anomaly detection on every system reachable by vendor, subcontractor and employee accounts.
Extend monitoring explicitly to vendor and subcontractor access paths — precisely where PowerSchool's blind spot was.
Theme Four — Third-Party & Vendor Risk
Two of the three breaches here — PowerSchool and Texas Parks & Wildlife — ran through a vendor or subcontractor. Under Texas law, that doesn't shift the notification burden: the breached organisation still owns the Chapter 521 obligations regardless of whose account was compromised.
Inventory every vendor/subcontractor account with data access, and verify — don't just ask — their actual controls.
Run a tabletop exercise assuming the breach originates in a vendor's environment — the scenario Texas's largest recent breaches actually followed.
Theme Five — Incident Response & Governance
Chapter 521 gives you 60 days to notify individuals and 30 days to notify the Texas AG once 250+ residents are affected. That clock starts at discovery. AG Paxton's office is currently demonstrating, via the PowerSchool suit, that it will litigate when the underlying security was inadequate.
Confirm a documented, rehearsed decision chain for a Texas breach specifically, including who calculates the 250-resident AG threshold.
Document your TDPSA Chapter 541 "reasonable security" position now — exactly the evidence PowerSchool didn't have.
How Paringa Helps
Everything above is achievable with an internal team and enough time. Where organisations bring us in is where a theme needs specialist capability delivered as a managed service.
Phishing-resistant, passwordless authentication — nothing to phish, reuse, or extend to a vendor account without scrutiny.
Data-layer tokenisation, so a compromised account or vendor breach surfaces worthless tokens rather than SSNs or medical records.
Continuous, managed detection across employee, vendor and subcontractor access paths, around the clock.
Independent verification of vendor and subcontractor security claims, plus practical hardening.
A rehearsed incident response framework mapped to the actual Texas Chapter 521 timeline.
What Happens Next
You don't need to fix all five themes at once. You need to know which is weakest.