Data Breach Reporting Checklist for Texas Small Businesses

10 parties, sorted by whether the report is required by law, required by contract, or recommended.

A Texas small business hit by ransomware or a data breach must notify affected individuals, and must notify the Texas Attorney General when at least 250 Texas residents are involved. Reports to FBI Houston, IC3 and CISA are voluntary for most private small businesses. Insurers, HHS and card brands come in with a policy, health data or card data.

The table below compares each party a Houston business may need to report a ransomware attack or data breach to, with the legal status of the report, the trigger, the deadline, the filing route and the information each party asks for.

Every deadline in the table comes from a primary source opened on October 3, 2026. Other card brands publish their own procedures, and those were not reviewed for this page. Your acquiring bank is the right first call for any card data question.

Section 521.053 sets 2 clocks with the same starting line and different finish lines.

Texas sets a 60-day outer limit for notifying affected individuals and a 30-day outer limit for notifying the Texas Attorney General. Both run from the date the business determines the breach occurred. The Attorney General notice applies when the breach involves at least 250 Texas residents, and it must be filed electronically through the Attorney General's website.

The current text reflects a 2023 amendment, Senate Bill 768, effective September 1, 2023. The Attorney General's reporting page dates the electronic-form requirement to the same day. A third-party page that gives a single 60-day deadline for everything does not match the text on the Texas Legislature's site as of October 3, 2026.

What starts the clock. A breach of system security is defined in Section 521.053(a) as unauthorized acquisition of computerized data that compromises the security, confidentiality or integrity of sensitive personal information. Encrypted data still counts if the person who took it has the key. The test is whether data was acquired. Ransomware that locks files in place and ransomware crews that copy files out first are different situations under that wording, and telling them apart is a forensic job.

What counts as sensitive personal information. Section 521.002 covers an unencrypted name combined with a Social Security number, a driver's license or government ID number, or an account or card number with the code that opens the account. It also covers information that identifies a person and relates to their health, their health care, or payment for it. That health branch carries no HIPAA condition in the definition, so a Houston business outside health care that stores such records should ask counsel whether it is covered.

The 30-day deadline sets the pace. The Attorney General's form asks for the number of Texas residents affected and the number already sent notice, as of the day you file. Letters to individuals have until day 60, yet the count behind them has to exist by day 30. The Attorney General's page tells a business that files an update to report the total affected and notified to date, so a first filing can be corrected as the investigation finishes.

One wording gap to hand to counsel. The statute counts from the date the business determines that the breach occurred. The Attorney General's page describes the deadline as 30 days after discovery of the breach. Those dates can differ. CinchOps plans its technical work to the earlier date and leaves the legal reading to the client's attorney.

Section 521.053 allows 2 delays: a law enforcement agency can ask a business to hold notice that would impede a criminal investigation, and the 60-day limit yields as necessary to determine the scope of the breach and restore the integrity of the system. Section 521.151 sets the penalty side. A violation of the chapter carries $2,000 to $50,000, and failing to take reasonable action on individual notice adds up to $100 per individual per day, capped at $250,000 for a single breach.

2 more facts shape the decision. The Attorney General posts a public listing of the breach reports it receives, and its page warns that a completed report is potentially an open record. A report filed in Austin about a Katy or Sugar Land business should be assumed readable by customers and competitors.

Contain first, call the people with contract deadlines second, report to law enforcement the same day, and leave the state filing for when the scope is known.

In the first 24 hours after ransomware or a hacked mailbox, a Houston business contains the incident, calls its cyber insurer and attorney, calls the bank if money moved, and reports to the FBI through the Houston field office or IC3. The Texas Attorney General report and the notices to individuals come later, once the scope is known.

• 1. Isolate, and write down the time. Disconnect affected machines from the network and leave them powered on, because shutting down destroys evidence held in memory. Record who found what and when. That record is what later fixes the date the breach was determined.
• 2. Call your IT provider or a breach response team. Containment and evidence preservation start here, before staff-wide emails that an intruder with mailbox access could read.
• 3. Call your cyber insurer and your attorney. The policy sets the insurer's notice deadline, and it may name the forensic and legal firms you are expected to use. Find the notice clause before you spend money on response.
• 4. If money moved, call your bank now. The FBI's guidance on business email compromise is to contact your financial institution immediately and ask it to contact the institution that received the transfer.
• 5. Report to the FBI the same day. Call FBI Houston at (713) 693-5000 or file a complaint at ic3.gov. The FBI states that it does not support paying a ransom, and that payment does not guarantee you get data back.
• 6. Consider a CISA report. The CISA Incident Reporting System at cisa.gov/report accepts voluntary reports from any organization.
• 7. If card data is involved, call your acquiring bank. Visa's procedures require immediate notice to the acquiring bank and a report to Visa within 3 calendar days of reasonable suspicion.
• 8. Hold the Texas filings until you have a count. The Attorney General's form cannot be saved and has to be completed in one sitting by an authorized representative, so it is filled in from a finished worksheet, days into the response.

The early calls change what the later reports say. An insurer that learns about the incident on day 1 can put counsel in place before the first written statement leaves the building. The FBI's advice on a diverted payment comes down to one word: immediately.

Evidence, scope and a count of affected people are technical findings, and every report in this guide depends on them.

An IT provider's work during a breach produces the facts every report depends on. The provider preserves evidence, determines what the intruder accessed or copied, and turns that finding into a list of affected people. That list decides whether the 250-resident Attorney General threshold is met and how many notices go out.

Preserve the evidence. Isolated machines, firewall logs, Microsoft 365 or Google Workspace sign-in records and backup snapshots are the raw material for the description of the breach that the Attorney General's form asks for. Wiping and rebuilding on day 1 feels productive and erases the proof of what was, and was not, taken.

Scope what was accessed. The Texas duty turns on whether sensitive personal information was acquired, or is reasonably believed to have been. Answering that means tracing which accounts the intruder used, which mailboxes and file shares those accounts could reach, and whether data left the network.

Build the count. Once the affected systems are known, someone has to open them and list the people whose records fit the Texas definition, then separate Texas residents from everyone else. A CPA practice in Sugar Land or a law firm in Katy holds exactly the name-plus-Social-Security-number and name-plus-account records that definition describes. In 35+ years of IT work, Shane Stevens has seen the same thing stall this step: the business cannot say what data lived on the machine that was hit.

The same team documents the measures taken and the measures planned, which are 2 of the 6 items Section 521.053(i) requires in the Attorney General report. Recovery runs in parallel. CinchOps keeps immutable, offsite backup copies for clients on its top-tier plan, so restoring systems does not depend on the intruder's cooperation.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

• Breach Response contains an active incident, preserves evidence and scopes what was accessed, which gives your attorney the facts for the Texas notices.
• Backup and Disaster Recovery keeps immutable, offsite copies so recovery can start while the investigation is still running.
• Multi-Factor Authentication Deployment closes the stolen-password route into a mailbox. The FBI's own business email compromise guidance tells businesses to turn it on and never disable it.
• Cybersecurity with 24/7 threat monitoring shortens the gap between an intrusion and the day you determine it happened.
• Cyber Insurance Readiness gets the policy, the notice clause and the claims contact into one place before an incident.
• Local coverage through managed IT in Houston and managed IT in Katy, with industry depth for law firms and CPA firms.

A reporting map is only useful if the facts behind it exist. The businesses that meet the 30-day Attorney General deadline without panic are the ones that already know where their sensitive records live and who their insurer's claims contact is. Build that list this quarter, keep it with your incident plan, and talk to CinchOps if you want a second set of eyes on it.