HOUSTON – On July 4, the Guadalupe River rose 26 feet in just 45 minutes, unleashing one of the worst natural disasters in Texas history and killing 135 people. In Kerr County, families lost homes, businesses, pets, keepsakes – entire lives were swept away in the muddy, violent rush of water.
But for many survivors, the disaster didn’t end when the river finally receded.
A new report shows that flood victims in Kerr County were targeted again – this time by cybercriminals around the world, intent on stealing millions of dollars in disaster relief meant to help people rebuild.
“They’d already taken everything”
It’s hard to grasp how much Lorena Guillen lost on July 4.
Her entire six‑acre RV park was destroyed and washed away. Her restaurant was closed down. Friends she loved were killed in the flood. The place she and her husband had spent years building was suddenly gone.
Then, just weeks later, she discovered that someone else was trying to take what little hope they had left.
Lorena got a call from the local Chamber of Commerce.
They wanted to confirm an address, they told her – the address where they should mail a grant check that she had applied for. Lorena was confused.
“I said I don’t know what you’re talking about,” she recalled. “And they said, ‘The grant you applied for.’”
She hadn’t applied for any grant.
Within days of the catastrophic flood, cyber thieves had somehow gotten ahold of her business records and her husband’s driver’s license. Using his identity, they had applied for a $25,000 federal disaster grant in his name.
“I saw that they had an application from us,” she said. “From someone impersonating my husband for a $25,000 grant.”
Money that was supposed to help them rebuild had almost been diverted to criminals who had never set foot on her land – or seen the wreckage left behind.
“So it’s devastation to me,” Lorena said. “We’re desperately in need of that money that was donated to us, and for those ugly people to come in and try to take it…”
The sentence trails off. The anger and hurt don’t.
A second wave of attacks – this time online
Lorena’s story is not an isolated case.
Socure, a cyber fraud prevention and digital identity verification company that works with the U.S. government and private businesses, has been tracking what happened digitally in the days and weeks after the Kerr County flood.
Its newly released report paints a grim picture: as survivors were ripping out soaked drywall, searching for missing belongings, and burying loved ones, cybercriminals were zeroing in on their identities.
Hackers from countries including China, Russia, India, Morocco, and Romania – as well as fraudsters here in the United States – set their sights on flood victims in Kerr County. Their goal: steal identities and intercept storm relief money meant to help real people put their lives back together.
Within just four days of the flood, digital attacks in Kerr County exploded.
“What we saw was a massive spike,” said Mike Cook of Socure. “It was 300% higher than it had ever been, and that was a lot of the local fraudsters that were attacking.”
And it didn’t stop there.
According to the report, every time state or federal officials – including Texas Governor Greg Abbott – announced new aid for storm victims, cybercriminal activity spiked again. Investigators saw surges of 200 to 250 percent in fraud attempts.
When asked how many people were targeted in just a two‑month span, Tim Cook with Socure didn’t hesitate: “Thousands.”
“The worst part,” he added, “is you’re hurting people at a terrible point in their lives. I mean, they’ve lost everything.”
Thousands of names. Thousands of wounds reopened.
Behind those statistics are real families – people already living with the trauma of a disaster that struck suddenly and violently.
Many woke up that July morning to alerts and sirens and went to bed that night with no home to return to, no clear idea of what came next. In that kind of chaos, disaster relief – grants, unemployment benefits, emergency payments – can mean the difference between sleeping in a car or having a place to stay. Between reopening a business, or closing it forever.
Cybercriminals saw an opportunity in that desperation.
They used stolen or fabricated identities to file for disaster grants, unemployment assistance, and other storm-related benefits under the names of real victims. In some cases, like Lorena’s, the fraud was caught before the money went out. In others, authorities say, criminals likely got away with funds that were supposed to help people who had already lost nearly everything.
For survivors, learning that their names, Social Security numbers, or business records were used by criminals can feel like reliving the disaster itself.
The violation is deeply personal. They’ve already watched their physical world be torn apart. Now, their identities – something invisible but just as defining – are under attack.
“Employees” who never existed
In Lorena’s case, the fraud didn’t end with the attempted grant theft.
Not only were her business records and her husband’s identity stolen, but cybercriminals also went a step further.
At least 30 fraudulent claims were filed with the Texas Workforce Commission, all tied to her small company. Each claim came from someone saying they had worked for her and were now owed lost wages – employees she says never existed, with names that were completely made up.
To Lorena, it felt like someone was systematically hijacking the life she and her husband had built.
Their land was gone. Their business was in ruins. And now strangers, hiding behind screens, were trying to drain the aid money that might help them start again.
A crime that preys on grief
Natural disasters are supposed to bring out the best in people: neighbors helping neighbors, strangers sending donations, volunteers clearing debris and handing out meals.
That certainly happened in Kerr County. Communities rallied. Donations flowed in. Local organizations, like the Chamber of Commerce, worked feverishly to connect survivors with help.
But in the background, a quieter, colder kind of activity was unfolding – one that most victims wouldn’t see until a call or letter alerted them that something was wrong.
The Socure report exposes that second disaster: one that exists in databases and application portals rather than flooded streets.
It shows that the moment money is put on the table for relief – whether it’s a $500 emergency check or a $25,000 grant – there are people ready to exploit it. And they are often fastest to move when legitimate victims are at their most overwhelmed, displaced, and distracted.
For flood survivors, it isn’t just about the lost money. It’s about the feeling that the system they turned to for help can be twisted against them – that somewhere, someone is watching and waiting for them to let their guard down.
“We just want to rebuild”
Months later, many Kerr County residents are still working to rebuild both their physical lives and their sense of security.
Some are navigating complicated processes to clear their names, prove that fraud occurred under their identities, and re-apply for aid. Others are still learning, often by surprise, that their information was used in ways they never authorized.
For people like Lorena and her husband Bob, it’s another burden piled on top of grief, stress, and financial uncertainty.
They are not just survivors of a historic flood. They are survivors of a second, invisible disaster – one that turned their hardship into a target.
And while investigators and companies like Socure continue to track the fraud, flag suspicious claims, and share their findings, the human cost of these attacks can’t be captured in percentages or charts.
It lives in the frustration of every phone call to a government office, the knot in the stomach when another unfamiliar letter arrives in the mail, and the lingering sense that even after the water went down, the danger never really went away.
“We’re desperately in need of that money that was donated to us,” Lorena said. “And for those people to come in and try to take it…”
For thousands of storm victims in Kerr County, that’s the deepest cut of all: that after losing so much, they may have to fight a second time – simply to keep what little help they were finally offered.