Our Business Email Was Hacked and Whether Texas Law Says We Must Notify Anyone

It is Tuesday afternoon and your office manager has just finished the worst part of the week. Someone got into her email account, sent a fake invoice to three of your clients, and set up a rule that quietly hid the replies. The password has been changed, the rule is gone, the clients have been warned, and everyone is ready to move on. Then your controller asks the question nobody in the room can answer. That mailbox held payroll attachments, a few scanned driver licenses from new hires, and years of client correspondence. Do we have to tell anyone that someone was inside it?

That question is the one most North Texas businesses skip, and it is the one that carries real legal exposure. Getting the attacker out of the mailbox is the urgent part. Working out what they could see, and whether that triggers a legal duty to notify people, is the part with a deadline attached. This post walks through how that decision works under Texas law, in plain English, so you know what to ask before the clock runs out.

One note before we start. We are not lawyers, and nothing here is legal advice. The decision about whether to notify belongs to you and your attorney. What we can tell you is how the process works, what the law looks at, and why the answer depends almost entirely on facts that only a proper investigation can establish.

Why a Hacked Mailbox Is Not Automatically a Data Breach

Business email compromise, usually shortened to BEC, is when a criminal takes over or imitates a business email account and uses it to steal money or information. Most owners think of it as a payment problem, because that is how it usually shows up. A client calls to ask about the new bank details. A vendor says they never received last month's payment. The money is the emergency, and rightly so.

But the law does not look at the money. Texas breach notification law, found in the Texas Business and Commerce Code at section 521.053, looks at information. The trigger is unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of what the statute calls sensitive personal information. In plain terms, if someone who should not have had it got hold of certain kinds of personal data about real people, you may have a duty to tell those people.

So the fact that an attacker logged in to an inbox is not, by itself, the deciding factor. The deciding factor is what was sitting in that inbox, and whether the attacker could reach it. A mailbox that only ever held meeting invites and supplier quotes is a very different situation from one that held employee tax forms. Two businesses with identical compromises can land on opposite answers.

What Counts as Sensitive Personal Information in Texas

The statute defines sensitive personal information in a fairly specific way. The core of it is a person's first name or first initial and last name, combined with one of several other items that is not encrypted. Those items include a Social Security number, a driver license number or other government issued identification number, or a bank account, credit card, or debit card number together with the code or password that would allow access to the account. The definition also covers information that identifies a person and relates to their physical or mental health, the health care they received, or payment for that care.

Now think about what actually lives in a typical office mailbox. A bookkeeper's inbox often holds W-2 forms, direct deposit forms with routing and account numbers, and copies of identification sent in during onboarding. A front desk inbox at a medical or dental practice holds insurance cards and referral letters. A property manager's inbox holds rental applications. A small law or accounting firm's inbox can hold the most sensitive documents a client owns, sent as attachments because email was the easiest way.

None of those messages were sent carelessly. Email is simply where business happens, and over five or ten years a single mailbox becomes an archive of everything that passed through it. That is why owners are so often surprised by what turns up when someone finally looks.

The Question That Decides Everything Is Scope

Here is the uncomfortable part. Changing the password and removing the forwarding rule tells you the attacker is out. It tells you nothing about what they did while they were in. To answer the notification question, someone has to reconstruct the attacker's activity from the evidence the system recorded.

In a Microsoft 365 environment, that evidence lives in audit logs. An audit log is a record the system keeps of who signed in, from where, and what they did. Depending on how your account is licensed and configured, those logs can show which messages were opened, which attachments were accessed, whether the attacker searched the mailbox for words like "invoice" or "W-2", and whether they used a tool to download the entire mailbox at once. A full download is the worst case, because it means everything in the archive should be treated as taken.

This is the work of digital forensics, which is the careful collection and analysis of system records to establish what happened, in a way that will hold up if anyone later asks how you reached your conclusion. It matters because the two possible mistakes both cost money. If you assume nothing was taken and you are wrong, you have missed a legal deadline. If you assume everything was taken when it was not, you may send notices to hundreds of people, alarm your clients, and spend money on credit monitoring for a breach that never touched their data.

There is also a time problem. Audit records do not last forever, and the retention period depends on your licensing. If nobody preserves them in the first few days, the evidence that could have narrowed your exposure may simply age out. That is one more reason the investigation has to start while the incident is still fresh, not after the clients have stopped calling. If you are still in the first two days, our guide to the first 48 hours after a compromised Microsoft 365 mailbox covers what to preserve before anything gets cleaned up.

The Two Texas Deadlines and When the Clock Starts

If the investigation and your attorney conclude that sensitive personal information was acquired, Texas sets two deadlines. Both are counted from the day you determine the breach occurred, not from the day the attacker first logged in.

The first deadline is to the affected individuals. The law requires notice without unreasonable delay, and in any case no later than 60 days after you determine the breach occurred. The second deadline applies when the breach involves at least 250 Texas residents. In that case you must also notify the Texas Attorney General, no later than 30 days after that same determination, using the electronic form on the Attorney General's website.

That 30 day figure catches people out. The Attorney General deadline used to be 60 days, and the Legislature shortened it to 30 in 2023. A great deal of guidance online, including material from IT providers in our own market, still quotes the old figure. If you plan your response around a 60 day window for the Attorney General, you can miss the real deadline by a month.

There are a few other rules worth knowing. If the breach involves more than 10,000 people at one time, you must also notify the nationwide consumer reporting agencies. If the data you hold actually belongs to another business, for example you are a payroll processor or a billing service working for a client, your duty is to tell that business so it can make its own notifications. And if a law enforcement agency asks you to delay notice because it would interfere with an investigation, the law allows for that.

The cost of getting this wrong is not abstract. Under section 521.151 of the same code, a business that fails to give the required notice can face a civil penalty of up to $100 for each person who should have been notified, for each day the failure continues, up to $250,000 for a single breach. That is before any separate penalty under the same law, before any lawsuit, and before the conversation you will have with clients who learn about the breach from someone other than you.

Where HIPAA, Clients, and Insurance Fit In

Texas law is not the only rule that can apply. If your business handles health information as a medical, dental, or behavioral health practice, or as a vendor to one, HIPAA can create its own notification duties with their own timelines. HIPAA, the federal Health Insurance Portability and Accountability Act, sets privacy and security rules for health information. A compromised front desk mailbox at a practice in Frisco or Plano is very often a HIPAA question as well as a Texas question, and your attorney will need to weigh both. Our overview of HIPAA cybersecurity requirements explains the basics.

It also helps to separate legal notice from client communication, because they are two different jobs. When a fake invoice goes out from your real address, you need to warn the people who received it the same day, before anyone else pays. That is about stopping fraud, and we cover how to word it in what to tell clients after a fraudulent invoice leaves your mailbox. A formal breach notice is something else. It tells people their personal information may have been taken, and it follows the rules the statute sets out. You may need to do one, the other, or both.

If you carry cyber insurance, call your carrier before you hire anyone or make any public statement. Many policies require prompt notice of an incident and expect you to use approved investigators and attorneys. Notification costs, such as mailing letters and offering credit monitoring, are often a covered expense, but only if the claim is handled the way the policy requires. Late notice to the carrier can turn a covered event into an argument.

What a Sensible Response Looks Like Over the First Week

Put the pieces together and a reasonable order of events starts to emerge. On the first day, the priority is containment and money. Secure the account, remove any rules or connected applications the attacker added, warn clients who received fraudulent messages, and if any payment went out, call the bank immediately. At the same time, preserve the audit logs before they age out, and tell your insurance carrier what happened.

Over the next several days, the investigation establishes scope. Which mailboxes were accessed, for how long, and what the attacker opened, searched for, or downloaded. That work produces a factual answer to the question your attorney actually needs, which is whether sensitive personal information was acquired, and whose. It also often reveals that the attacker had access to more than one account, because these intrusions frequently start with one stolen password and spread.

Once the facts are in hand, your attorney decides whether notice is required and to whom, and the clock you are working against is the one that started on the day you made that determination. Some businesses discover that the exposure was narrow and no notice is needed, and they have the records to show why. Others discover that a single bookkeeping inbox held identification and banking details for every employee they have hired in a decade.

Finally, close the door that let the attacker in. That usually means stronger sign in protection, better email security that filters the messages used to steal passwords, and dark web monitoring that alerts you when company credentials show up for sale. Those measures do not answer the notification question, but they reduce the chance you face it twice.

Our team works this kind of incident for businesses across McKinney, Allen, Plano, Frisco, and the wider Collin County area. The business email compromise response we provide is built around exactly this sequence. Contain the account, preserve the evidence, establish what was reachable, and hand your attorney a clear factual answer they can make a legal decision on. If you are trying to understand how your own environment would hold up, our free assessment is a reasonable place to start.

If this is happening to you right now, call us at 512-518-4408 or reach us through our contact page. We are based in McKinney and work with businesses throughout North Texas, and the earlier we can preserve the evidence, the more options you keep.

Frequently Asked Questions

Do I have to notify customers if our business email was hacked in Texas?

Not automatically. Texas law requires notice when sensitive personal information, such as a name combined with a Social Security number, driver license number, or financial account details, was acquired by someone without authorization. Whether that happened depends on what was in the mailbox and what the attacker could reach, which is why an investigation and an attorney's review come before the decision.

How long does a Texas business have to send breach notification letters?

Affected individuals must be notified without unreasonable delay and no later than 60 days after you determine the breach occurred. If 250 or more Texas residents are affected, the Texas Attorney General must also be notified within 30 days of that determination using the online form, a deadline that was shortened from 60 days in 2023.

What happens if a business does not send a required breach notice?

Under section 521.151 of the Texas Business and Commerce Code, a business that fails to give required notice can face a civil penalty of up to $100 per affected person for each day of the failure, capped at $250,000 for a single breach. Missing the deadline can also create problems with insurance claims and with clients who hear about the breach elsewhere.

Is warning clients about a fake invoice the same as a breach notification?

No. Warning clients about a fraudulent invoice is about stopping them from sending money to a criminal, and it should happen the same day. A breach notification is a formal notice that personal information may have been taken, and it follows the timing and content rules set by law. Many businesses end up doing both.

How do we find out what an attacker saw in our mailbox?

The answer comes from the system's audit logs, which can record sign ins, messages opened, searches, and bulk downloads, depending on your licensing and settings. Those records expire, so they need to be preserved quickly and reviewed by someone who can document the findings clearly enough for your attorney and your insurer to rely on.