Tarrant Appraisal District Ransomware and What Fort Worth Businesses Do Next

In March 2024, the Tarrant Appraisal District in Fort Worth was hit by a ransomware attack. Ransomware is criminal software that locks up an organization's files and computers until a payment is made, and the groups behind it now usually steal copies of the data first so they can threaten to publish it. A group called Medusa claimed responsibility, and news reports at the time put its demand at roughly half a million dollars. Online services were disrupted as the district headed into the busiest stretch of its year, when property owners and the tax consultants who represent them file value protests.

If you own a building, lease commercial space, or pay business personal property tax anywhere in Tarrant County, you have a relationship with that agency. That is the point of this post. Most owners read a story like this as somebody else's problem. It becomes your problem the moment the information that flows between you and a breached organization lands in a criminal's hands, because that information is exactly what a convincing fake invoice is built from.

We wrote about the same pattern after the JPS hospital cyber attack and the City of Dallas ransomware attack. The appraisal district case is worth its own look because of who sits on the other side of it. It is not patients or residents. It is businesses, property managers, and the firms that send them bills.

What Happened at the Appraisal District and Why It Matters to You

An appraisal district sets the taxable value of property. For a commercial owner, that value drives one of the largest fixed costs on the books. Every spring, owners and their representatives exchange letters, evidence packets, rent rolls, income statements, and payment correspondence with the district and with each other. A lot of that traffic moves by email.

When a ransomware group says it has taken data from an organization like this, you should assume three kinds of information may be in play. The first is names and contact details for owners, agents, and staff. The second is the correspondence itself, meaning who writes to whom, how they sign their messages, and what a normal request looks like. The third is financial context, such as which properties are under protest, what consultants are being paid, and when payments are due.

None of that lets a criminal break into your bank account directly. What it does is let them write an email that looks completely routine to your bookkeeper. That is the real downstream risk, and it is why we read incidents like this one as a warning about business email compromise more than about ransomware.

Why a Public Agency Breach Turns Into Fake Invoices at Your Company

Business email compromise, usually shortened to BEC, is a scam where a criminal either takes over a real mailbox or imitates one closely enough to trick someone into sending money. It is the single most common reason North Texas businesses call us for help, and it is far more common than the ransomware headlines suggest.

Here is how it connects to an incident like this. A criminal who knows that your company is protesting the value of a warehouse, and knows the name of the consultant handling it, does not need to hack anyone else. They register a lookalike email domain, copy the consultant's signature block, and send your controller a short note saying the firm has changed banks and the contingency fee should go to a new account. The timing is right, the amount is plausible, and the names are real. That is why it works.

The same playbook runs in the other direction. If you are a vendor who invoices a breached organization, criminals can pose as you to your own customer. Your client receives an invoice that looks like yours, pays it to the wrong account, and then calls you asking why you have not credited the payment. Now you are in the middle of a dispute you did not cause, with a customer relationship at stake.

The business consequences are concrete. A typical fraudulent wire or ACH payment at a small firm runs from the low five figures into six. Cyber insurance policies often cover social engineering fraud only under a separate, smaller limit, and only if you can show you followed your own payment verification procedure. If the money leaves the bank and nobody acts in the first day, the chance of getting it back drops sharply.

The First Hour After You Realize You Paid the Wrong Account

We are going to spend most of this post on response, because that is where owners lose the most money. Prevention advice is everywhere. What is missing is a clear sense of what to do when the payment has already gone out.

The first call is to your bank's fraud department, not your account representative and not your IT person. Ask the bank to initiate a recall of the wire or a return of the ACH payment and to contact the receiving bank immediately. Banks have a formal process for this, and it moves faster the earlier it starts. We walk through that process step by step in how North Texas businesses recover money after paying a fake invoice, and we cover the accounting side in what your accounting team does in the first hour after a fake ACH payment.

The second step is to file a complaint with the FBI's Internet Crime Complaint Center, known as IC3, which is the federal agency's online reporting portal for fraud. A filed report gives the bank and law enforcement something to act on, and your insurer will usually ask for it.

The third step is to stop touching the evidence. Do not delete the fraudulent email, do not forward it around the office, and do not reply to the sender. The message headers show where it really came from, and that detail decides whether this was an outside imitation or a takeover of a real mailbox. That distinction matters for everything that follows, including who is likely to bear the loss.

Finding Out Whether the Problem Is Inside Your Own Mailbox

Once the money is being chased, the next question is whether the criminal was ever inside your systems. Many owners assume the fraud came from outside because the email came from a lookalike address. Often it did. Sometimes, though, the criminal had already taken over one of your own mailboxes and used it to watch conversations, learn the timing, and hide replies.

There are a few signs that point to a takeover. Someone may find mail rules they did not create, such as rules that move messages containing the word invoice into an obscure folder. Coworkers or clients may report emails your staff do not remember sending. There may be sign-ins from cities or countries where nobody on your team was working. Any of these means the incident is bigger than one payment.

A takeover needs a different response. Passwords must be reset and every active session signed out, the hidden rules must be removed, and someone has to determine what the criminal read while they were inside. That last step is where digital forensics comes in. Forensics is the careful, documented review of logs and systems to establish what happened, in a form an insurer, a lawyer, or a regulator will accept. Our business email compromise response service handles containment and that review together, so you are not coordinating three vendors in the middle of a crisis. If it is a Microsoft 365 mailbox, our guide to the first 48 hours after a compromised mailbox shows what that work looks like hour by hour.

Who Pays When the Vendor Was the One Who Got Hacked

This is the question owners ask us most often, and the honest answer is that it depends on facts you can establish in the first week. It is a business and legal question, and your attorney and insurer will have the final word, but you should understand the pieces before you talk to them.

The first piece is whose systems were compromised. If the criminal was inside your vendor's mailbox and sent you an invoice from their real address, you have a stronger argument that the failure was on their side. If the criminal imitated your vendor from a lookalike domain and your team did not verify the new bank details, the loss often lands with the company that paid. Forensic evidence is what separates those two stories, which is why preserving the email matters so much.

The second piece is your contracts. Some vendor agreements and purchase terms say who bears the risk of a payment sent to the wrong account. Many say nothing, and that silence usually becomes a negotiation.

The third piece is insurance. Check whether your policy covers social engineering fraud, what the sublimit is, and what verification steps it requires you to have followed. Report the claim promptly, because late notice is one of the easiest ways to lose coverage.

The fourth piece is notification. If the criminal was inside your mailbox, customer or employee personal information may have been exposed. Texas law requires businesses to notify affected Texas residents within 60 days of determining a breach of sensitive personal information, and to notify the state attorney general when 250 or more Texans are affected. Whether that duty applies depends on what was actually in the mailbox, which again comes back to the forensic review.

What a Tarrant County or Collin County Owner Should Do This Week

You do not need to wait for a fraud attempt to act on the lesson from the appraisal district. Here is what we recommend to owners from Fort Worth to McKinney, Plano, and Frisco, written as a short plan rather than a checklist.

Start by calling your accounts payable lead and agreeing on one rule. Any change to a vendor's bank details is confirmed by a phone call to a number you already have on file, never a number from the email requesting the change. That single rule stops most of the fake invoices we see. Put it in writing so it also satisfies your insurer's verification requirement.

Next, make a short list of the outside organizations that hold your financial correspondence. That includes your appraisal district or property tax consultant, your bank, your payroll provider, and your largest vendors and customers. When one of them announces a breach, treat it as a signal to tighten verification on payments to and from that party for the following several months. Criminals often sit on stolen data and use it later, when the headlines have faded.

Then check whether your own staff credentials are already circulating. Passwords taken from other breaches are a common way into a mailbox. Dark web monitoring watches the criminal marketplaces where stolen logins are traded and tells you when a company address appears, so you can reset it before someone uses it.

Finally, look at the mailbox protections you already pay for. Most Microsoft 365 and Google Workspace accounts ship with settings that would flag lookalike domains and warn staff about outside senders, and many businesses never turn them on. Our email security service configures and monitors those protections. Pair that with backups you have actually tested, so a ransomware event at your own company is a bad week rather than a closed business.

If you are in Collin County, the same advice applies to every public agency and large institution you deal with. The organization in the headline will change. The fake invoice that follows it looks the same each time. Our team is based at our McKinney office and responds across North Texas and the wider DFW area.

Talk to Someone Before the Next Invoice Arrives

If you think you have paid a fraudulent invoice, call your bank's fraud desk first, then call us at 512-518-4408. We will help you contain the mailbox, preserve the evidence your insurer will want, and work out what needs to be reported and to whom.

If nothing has happened yet, a short review of how your company approves payments and protects its mailboxes is the cheapest protection you can buy. You can request an assessment or contact our team to set one up. It takes about an hour, and you will leave with a clear picture of where a fake invoice would get through today.

Frequently Asked Questions

Was my business data exposed in the Tarrant Appraisal District ransomware attack?

Only the appraisal district can confirm what was taken and whose information was involved, so watch for any notice it sends you and read it carefully. Even if your records were not involved, treat any unexpected request to change payment details from a tax consultant, vendor, or agency as suspicious. Confirm it by calling a number you already have on file.

Our vendor's email was hacked and we paid the fake invoice. Is that our loss or theirs?

It depends on whose systems were actually compromised, what your contract says about payment risk, and what your insurance covers. If the criminal was inside the vendor's real mailbox, you have a stronger case that the loss is theirs. If the email came from a lookalike address and your team skipped verification, the loss often stays with the payer. A forensic review of the email is what settles the question.

What should I do first if we wired money to a fraudulent account?

Call your bank's fraud department immediately and ask it to recall the wire and contact the receiving bank. Then file a report with the FBI's Internet Crime Complaint Center and notify your cyber insurer. Keep the fraudulent email untouched, because it is the evidence that decides what happened and who bears the loss.

How do criminals use a public agency breach to target local businesses?

They use stolen names, correspondence, and payment timing to write emails that look routine, often posing as a consultant, vendor, or the agency itself. The goal is usually a changed bank account or an urgent payment request. A rule that every bank change is confirmed by phone stops most of these attempts.

Does cyber insurance cover a fake invoice payment?

Many policies cover it under a social engineering or funds transfer fraud section, usually with a lower limit than the main policy. Coverage often depends on showing that your staff followed a written verification procedure before paying. Review that section of your policy now, before you need it.