Tyler Technologies tylertech.com Tyler Technologies data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In October 2018, Tyler Technologies said a file of usernames and passwords for tylertech.com accounts was briefly reachable through its website search. It reset the affected passwords and had no evidence anyone used them. The notice doesn't say how many accounts were involved.
View all 13,118 breaches- Breach date
- 8 Oct 2018
- Made public
- 16 Oct 2018
- Data exposed
- Usernames, Passwords
- Last updated
In October 2018, Tyler Technologies, a software company that sells systems to local governments and schools, told customers that a file of usernames and passwords for tylertech.com accounts had been exposed on its own website. The California Attorney General's breach list records the incident with a discovery date of October 8, 2018.
What happened
Tyler's notice email, dated October 16, 2018, says the file was reachable through the site's search function, but only if someone searched with a very limited set of parameters. The company removed it shortly after learning of the problem and said it appears to have been accessible for less than a week. Tyler said it had no evidence anyone used the information to log in to an account.
This was an exposure, not a break-in: the company's own notice describes a file left where search could find it, and it doesn't describe an attacker. The notice doesn't say how many accounts were in the file, so the number of people affected isn't public.
Sources checked: oag.ca.gov, consumer.ftc.gov, cisa.gov
Last verified against the official page:
What was exposed
The notice names usernames and passwords for tylertech.com accounts. It doesn't mention names, addresses, financial details or government IDs. A username and password pair matters most if you used the same combination somewhere else, because criminals try leaked logins on other sites.
What Tyler did
Tyler reset the password on every affected account and emailed each person. It asked them to set a new password through the normal login page and to change the same password on any non-Tyler account where they had reused it. It also warned people to watch for phishing emails and phone scams, and never to give personal information to someone whose identity they haven't verified.
What to do if you were in it
- 1
Change the password if you ever had a tylertech.com login
Tyler reset the affected passwords in 2018, but if you used the same password on another account, change it there too. The FTC advises using a different password for each account.
- 2
Turn on two-factor login where you can
A second step, such as a code from an authenticator app, stops a stolen password from being enough on its own. CISA recommends turning it on for important accounts.
- 3
Be careful with emails and calls that mention the incident
Tyler warned people to watch for phishing emails and phone scams and not to share personal information with anyone they haven't verified. Go to the company's site yourself instead of clicking a link in a message.
- 4
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see which breaches include your details. Serus monitors breach databases and the dark web and alerts you when your data appears, and tells you what to do next.
Frequently asked
Was I affected by the Tyler Technologies breach?
Only if you held a tylertech.com account whose username and password were in the file. Tyler emailed those people on October 16, 2018.
What was exposed?
Usernames and passwords for tylertech.com accounts. Tyler's notice doesn't mention any other kind of personal data.
Should I change my password?
Tyler reset the affected passwords itself. Change it anywhere else you used the same password, as Tyler advised and as the FTC recommends.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
