Texas Cyber Command’s “Texas First. Cyber Ready.” Month Meets Live Phishing Reports

October is Cybersecurity Awareness Month. The San Antonio–based Texas Cyber Command is running “Texas First. Cyber Ready.” — free public webinars on phishing, identity theft, and multi-factor authentication. The same week, two local law-enforcement offices told Texans that phishing mail is already in inboxes.

KENS 5 (Oct 7) recapped the statewide campaign. Click2Houston (Oct 4) carried Harris County Constable Mark Herman’s “pause before you click” reminder. Crossroads Today (Oct 8) reported that the Lavaca County Sheriff’s Office is seeing phishing that can look like trusted mail.

This is awareness plus local alerts, not a reported breach of TXCC, DIR, Harris County Precinct 4, or Lavaca County.

Official campaign: Texas First. Cyber Ready. — Cybersecurity Awareness Month 2026

Snapshot

House Bill 150 (89R, 2025) created TXCC and moved DIR cybersecurity operations to the Command. Headquarters is San Antonio. The public site still says stand-up in progress.

What TXCC is offering this month

Webinars are free, open to the public, and start at 10:00 a.m. Central (60 minutes). Register on the campaign page — type that address; do not use a “TXCC webinar” link from unexpected mail.

Week 1 (Oct 8, public-private partnerships) has already run. Questions: TXCCSecurity@txcc.texas.gov.

Government organizations still have a clock: report a qualifying incident within 48 hours of discovery (24 hours encouraged). The incident hotline is 877-347-2476. Calling it satisfies the statutory report. TXCC does not investigate private-citizen account takeovers — use local police, ReportFraud.ftc.gov, or IC3.

Local phishing, same week

Harris County Constable Precinct 4

Constable Mark Herman’s office told residents to treat unexpected email, texts, links, and attachments as suspect. Urgency is a tell. Type a number you already have. Do not enter a password on a page you reached from a cold message.

The office site is constablepct4.com. Dispatch: 281-376-3472.

Lavaca County Sheriff’s Office

LCSO told Hallettsville-area residents a phishing wave is circulating. Mail may look like a trusted sender and ask you to click or open an attachment. LCSO also heard similar messages hit other state, federal, and private inboxes. They did not publish a From address. Do not hunt for one.

Sheriff: co.lavaca.tx.us · 361-798-2121.

If you already clicked: tell IT or the sheriff’s office, reset passwords on hosts you type, and scan the device.

MFA: YubiKey and Google Authenticator

TXCC’s Oct 15 session is credential hygiene and MFA adoption. A hardware key does not un-click a fake “sheriff document.” It does stop a lot of replay after someone phishes email OTP. Grades match our MFA directory. Email OTP remaining is Fail even when a security key exists.

DIR’s TIAM / TDIS page documents authenticator app and security key, plus FIPS hard tokens for eligible agencies. The TDIS enrollment guide still walks users through a work-email verification code. Email remaining keeps the grade at Fail. Google Authenticator is not named. Prefer a security key or authenticator on a managed phone when your agency offers it.

Directory: MFA support directory · Category → Business Apps.

Recommended MFA tools

We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.

Independent cybersecurity audits

We audited the Command host, DIR, Constable Pct. 4, and Lavaca County on October 10, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not mean TXCC or either sheriff’s office was breached.

Audit links: co.lavaca.tx.us · dir.texas.gov · txcc.texas.gov · constablepct4.com

constablepct4.com Identity 0% is why a fake “Constable Herman cybersecurity month” message can sit next to a real one. Type constablepct4.com and txcc.texas.gov. All four hosts sit at Transport 15% — spoofed “official” mail is easier to deliver than the 100% ideal.

Website stack

Passive homepage + Certificate Transparency probes (October 10, 2026). Versions only.

jQuery 1.8.3 on the constable site is a freshness note, not a how-to. A short Google leaf date is a certificate calendar note, not an outage.

Blacklist and lookalikes

Email blacklist checks (public DoH, October 10, 2026): txcc.texas.gov, dir.texas.gov, and co.lavaca.tx.us were clear. constablepct4.com showed UCEPROTECT Level 3 hits on shared GoDaddy / secureserver.net MX — provider-netblock noise. We do not treat that as the office being blacklisted.

Registered lookalikes (BEC profile — not proof this week’s lures used them):

The TXCC pass expands the registrable parent texas.gov. The Lavaca pass expands .tx.us. Hosts such as texas.com or tx.com are ordinary commercial TLD swaps — not evidence they were used in the LCSO wave. Type txcc.texas.gov, dir.texas.gov, constablepct4.com, and co.lavaca.tx.us. Continuous monitoring: Cybersquat Domain Monitoring.

CourtListener RECAP searches for Texas Cyber Command, the Lavaca phishing wave, and Constable Herman’s alert did not return a matching docket.

What Texans should do

1. Register for the Oct 13 and Oct 15 TXCC webinars from the typed campaign page.
2. Forward suspected phishing as an attachment to phishing@txcc.texas.gov. Do not click to “check” it.
3. Bookmark txcc.texas.gov, constablepct4.com, and co.lavaca.tx.us.
4. If your agency is on TDIS, enroll a security key or authenticator — do not stay on email OTP.
5. Government IT: know the 48-hour TXCC report clock and the 877-347-2476 hotline.

Related coverage

• HHSC STEPS PFD-logo phishing
• Princeton TX ransomware claims
• Texas AG CIPA demand letters
• MFA support directory

Sources: TXCC Cybersecurity Awareness Month · TXCC incident reporting · KENS 5, Oct 7, 2026 · Click2Houston, Oct 4 · Crossroads Today, Oct 8 · DIR TIAM / TDIS · TDIS enrollment guide. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 10, 2026. Domain scores: audit.emailmenow.com only. No lure URLs, exploit PoCs, or sample pages in this post.