City of Carthage Data Breach Exposes PHI and PII of 5,861 Individuals

On Feb. 20, 2026, the City of Carthage, Texas began notifying residents and individuals whose personal information was compromised in a data breach. The incident was first identified on Dec. 17, 2024, when the city detected potential unauthorized access to its network.

Subsequent forensic analysis, supported by external cybersecurity professionals, revealed that an unauthorized actor had accessed the city’s systems and may have viewed or obtained sensitive files.

After a thorough investigation and manual document review, it was determined on Jan. 22, 2026, that certain personal information had been included in the data accessed by the unauthorized party.

So far, 5,858 people in Texas and three in Maine were affected, according to filings with the Texas Attorney General and the Maine Attorney General. The city has posted a public notice about the breach on its website.

The exposed information included a range of personally identifiable information (PII) and protected health information (PHI): names, addresses, Social Security numbers, driver’s license or state identification numbers, financial account details such as account numbers and credit or debit card numbers, medical information, health insurance details, taxpayer identification numbers and passport information.

City of Carthage, Texas’ response

For those whose Social Security numbers were involved, the city is offering complimentary credit monitoring services. Affected individuals are encouraged to remain vigilant by reviewing financial account statements and credit reports for any irregular activity.

The city’s notice also provides instructions on how to place a fraud alert or security freeze on credit files, as well as how to obtain a free credit report. Additionally, the city has established a dedicated toll-free response line at 844-425-3609, available Monday through Friday, 9 a.m. to 9 p.m., to answer questions and assist those impacted.

Individuals are advised to contact their financial institutions if their financial account information was affected, and to follow best practices for protecting medical information, such as reviewing health insurance statements and contacting providers for any unrecognized services.