Nacogdoches County phishing disrupts payroll access

Analyst assessment

DysruptionHub assesses with high confidence that Nacogdoches County, Texas, experienced a cyber incident identified on May 28, 2026. County Judge Chris Bentley attributed the event to phishing, while the county’s official notice said a limited number of county systems were affected and the incident had been contained and remediated.

DysruptionHub’s published report documented the phishing attribution and the operational effects described by county officials. The public record does not establish whether phishing led to credential compromise, mailbox access, malware execution or another follow-on mechanism.

Operational significance

The incident disrupted online access to employee pay stubs. County officials said employees were receiving paper pay stubs because online access was unavailable, creating a manual administrative workaround. Payroll payments continued, and officials said county finances, sheriff’s office operations, emergency services and general county services were not affected.

The county also accelerated a previously planned transition from its former website to a new .gov domain. Sheriff information was still being migrated, and residents seeking jail-roster information were directed to booking summaries and daily activity reports while new pages were built. The public record does not establish that every website limitation resulted directly from the cyber incident.

Disclosure posture

The county initially said no residents were affected and described the affected population as a limited number of former sheriff’s office employees, including some current county employees whose exposure related to prior sheriff’s office service. It offered direct notice and free credit monitoring.

A Texas Attorney General breach listing, published July 7, reported 1,100 affected Texans and listed names, addresses, Social Security numbers, driver’s-license numbers, medical information and another unspecified data type as affected. The listing establishes a substantially larger affected-person count than the county’s initial description suggests, but the available record does not reconcile that difference or establish that data was copied, removed or publicly disclosed.

In a July 9 KTRE interview, Bentley said the breach affected a select few county employees, involved a limited amount of data and prompted an ongoing investigation, infrastructure review and accelerated website replacement. That account reinforces the county’s limited-scope characterization but does not resolve the discrepancy with the Attorney General filing.

Current status

The latest confirmed operational observation was July 1, when online pay-stub access remained unavailable and paper stubs were still being used. Searches through August 3 found no later evidence that the disruption or workaround continued and no service-specific restoration notice. The operational impact is therefore presumed resolved after 33 days without a newer observation; this is a time-based lifecycle assessment, not an authoritative all-clear or a known restoration date.

Confidence and uncertainty

Confidence is high that phishing was involved, that online pay-stub access was disrupted and that the incident affected personal information. The public record does not establish financial loss, missed payroll, interruption to emergency services or a broad county-system outage. Ransomware and threat-actor attribution remain unresolved: no encryption, ransom demand, extortion activity, payment or actor claim was identified.

Analytic gaps

The reviewed sources do not identify the phishing lure, targeted account, credential or session compromise, affected systems, exact duration of pay-stub unavailability, restoration method, or whether affected data was copied or removed. They also do not reconcile the county’s description of a limited number of affected former sheriff’s office employees with the Texas Attorney General’s report of 1,100 affected Texans.