Nacogdoches County phishing disrupts payroll access

Analyst assessment

DysruptionHub assesses with high confidence that Nacogdoches County, Texas, experienced a cyber incident identified on May 28, 2026. County Judge Chris Bentley attributed the event to phishing, while the county’s official notice said a limited number of county systems were affected and the incident had been contained and remediated.

DysruptionHub’s published report documented the phishing attribution and the operational effects described by county officials. The public record does not establish whether phishing led to credential compromise, mailbox access, malware execution or another specific follow-on mechanism, so the attack remains characterized as phishing without inferring a more precise technical path.

Operational significance

The incident disrupted online access to employee pay stubs. County officials said employees were receiving paper pay stubs because online access was unavailable, creating a manual administrative workaround. Payroll payments themselves continued, and officials said county finances, sheriff’s office operations, emergency services and general county services were not affected.

The county also accelerated a previously planned transition from its former website to a new .gov domain. Sheriff information was still being migrated, and residents seeking jail-roster information were directed to booking summaries and daily activity reports while new pages were built. The public record does not establish that every website limitation resulted directly from the incident.

Data impact and disclosure

The county initially said no residents were affected and described the affected population as a limited number of former sheriff’s office employees, including some current county employees whose exposure related to prior sheriff’s office service. It offered direct notice and free credit monitoring.

A later Texas Attorney General breach listing, published July 7, reported 1,100 affected Texans and listed names, addresses, Social Security numbers, driver’s-license numbers, medical information and another unspecified data type as affected. The listing confirms a substantially larger affected-person count than the initial public description suggests, but the available record does not reconcile that difference or establish that data was copied, removed or publicly disclosed.

In a July 9 KTRE interview, Bentley said the breach affected a select few county employees, involved a limited amount of data and prompted an ongoing investigation, infrastructure review and accelerated website replacement. That account reinforces the county’s limited-scope characterization but does not resolve the affected-count discrepancy in the AG filing.

Current status

The county said the cyber incident was contained and remediated, but that statement is not a documented restoration of the affected pay-stub service. The latest confirmed operational observation, reported July 1, was that online pay-stub access remained unavailable and paper pay stubs were still being used. No later source located by July 26 confirmed that access was restored or the workaround ended. With 25 days since that observation, the incident is presumed active under the operational-impact lifecycle; this status reflects the absence of a documented all-clear rather than evidence of a renewed or broadening outage.

Confidence and uncertainty

Confidence is high that phishing was involved, that online pay-stub access was disrupted and that the incident affected personal information. The public record does not establish financial loss, missed payroll, interruption to emergency services or a broad county-system outage. Ransomware and threat-actor attribution remain unresolved: no encryption, ransom demand, extortion activity, payment or actor claim was identified.

Analytic gaps

The reviewed sources do not identify the phishing lure, targeted account, credential or session compromise, affected systems, exact duration of pay-stub unavailability, or whether affected data was copied or removed. They also do not reconcile the county’s description of a limited number of affected former sheriff’s office employees with the Texas AG’s report of 1,100 affected Texans.