New Mexico Department of Wildlife
New Mexico Game and Fish bot attack
Summary
An Aug. 29, 2025 bot attack prompted New Mexico’s Department of Game and Fish to shut down online card payments for hunting and fishing licenses and permits. The agency restored card sales by Sept. 4 and said the attack was isolated to payment processing without customer data exposure.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing. -
Incident end:
?
Confirmed or defensibly assessed end of material operational disruption or incident activity.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
No known data impact
Available evidence indicates that the incident did not materially affect the confidentiality, integrity, or availability of data.
Operational impacts
-
Payment processing disruption
The organization could not process, receive, issue, reconcile, or record payments normally.
-
Government services disrupted
Public administrative, licensing, permitting, court, tax, records, benefits, or other government services were materially affected.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
The New Mexico Department of Game and Fish experienced a bot attack on its payment-processing system Aug. 29, 2025. The agency’s initial notice said it shut down online card processing, preventing customers from completing credit or debit card purchases of hunting and fishing licenses and permits.
We reported the disruption Aug. 30. The incident affected an operational transaction channel even though customers had alternative ways to obtain licenses.
Operational significance
The initial notice directed customers to approved vendors for cash purchases and noted that many vendors could independently accept cards. Those alternatives preserved access to licenses but required customers to use a different sales channel.
In its Sept. 4 restoration notice, the agency said credit and debit card purchases were available again through its online licensing system, department offices and vendors statewide. The notice identifies a recovery milestone for the affected payment function.
Confidence and uncertainty
Confidence is high that malicious automated activity caused material disruption because the affected agency identified the bot attack and documented the resulting shutdown. Its restoration account says the security team isolated the attack to payment processing and that customer data was not exposed.
The term bot attack describes automation, but the reviewed notices do not establish distributed denial of service, card testing, credential abuse, exploitation of a particular vulnerability or ransomware. They also do not identify a responsible actor. The defensive shutdown should not be generalized into compromise of every agency system.
Analytic gaps
The technical entry or abuse method, volume of malicious transactions or requests, total failed purchases, revenue effect and response cost remain unestablished. The reviewed evidence does not identify a ransom demand or payment. The data finding is the agency’s reported assessment rather than an independently published forensic analysis.
The specified payment disruption is resolved based on the agency’s Sept. 4 restoration announcement. Aug. 29 is the verified attack and initial-impact date. Sept. 4 records restoration by that update, without establishing an exact intraday recovery time; the previous draft’s Aug. 28 onset and Sept. 3 end were unsupported.
Organizations involved
Impacted locations
New Mexico
The agency’s licensing and permit-payment service serves customers across New Mexico. This governmental service area identifies the affected function’s statewide remit without asserting that all state systems or residents were affected.
Santa Fe, New Mexico
Preserves Santa Fe as the agency headquarters municipality anchor. The payment service had statewide reach, represented separately; this relationship does not assert a citywide outage.
Sources
Our initial report described online card-payment shutdown and vendor alternatives after bot activity.
The agency said a bot attack caused it to disable online card processing for hunting and fishing licenses and permits.
The agency said card sales were restored online and in person, the attack was isolated to payment processing and no customer data was exposed.
See something that needs correction?
Signed-in members can report an error, update, or missing source.