An undisclosed number of Oklahomans received letters this week informing them that their data had been leaked in a breach of the Oklahoma Taxpayer Access Point (OkTAP) system.
In the letter, the Oklahoma Tax Commission writes that staff learned of suspicious activity at the end of last year. An investigation concluded that between September and December of 2025, there was unauthorized access to W-2 and 1099 files.
The information accessed includes names and Social Security numbers. These data points, if obtained by individuals with fraudulent intent, can be used to make financial transactions in the name of another person, like taking out a new credit card or applying for a loan.
If you received one of these letters, here's what you need to know.
How do I make sure my data isn't used for fraudulent transactions?
If your data has been leaked, there are a few steps you can take to limit potential damage. First, the state has offered 12 months of free credit monitoring services to those affected through Cyberscout. Eligible individuals should see a code in the letter for them to enter on Cyberscout's website. You need to enroll within 90 days to secure that offer.
Credit monitoring services notify you of changes to your credit reports, like new accounts and missed payments, allowing you to be hyper-vigilant about any transactions you did not authorize. However, credit monitoring in and of itself does not prevent fraud.
A credit freeze is a surefire way to stop fraudulent accounts from being opened in your name. However, it also stops you from opening any new accounts while the credit is frozen, so if doing so is on your radar soon, a credit freeze may not be the best fit for you.
How can I freeze my credit?
There are three nationwide credit reporting companies: Equifax, TransUnion and Experian. To freeze your credit, you'll have to log in to all three of them and put a freeze on your account. If you don't have a profile with these agencies, you can make one for free. You just may need to bypass their paid subscription offers.
If you wish to unfreeze your credit at any point, you can log back into those accounts and do so.
What can I do if I am the victim of identity theft?
Through Equifax, TransUnion and Experian, you can dispute transactions that aren't yours. You can aid your case for a dispute by providing evidence that you didn't make the transaction.
If your dispute is denied, you may need to contact the credit card company, bank or other entity associated with the fraudulent transaction. Many have a phone number you can call to get assistance with the dispute.
You also may want to report identity theft to the Federal Trade Commission.
What do we know about the Oklahoma Tax Commission breach?
The OTC has said it "cannot speak" to the total number of individuals involved. However, KFOR reports that 14 people in Maine were affected by the breach, so the incident seems to have crossed state lines.
At least some letters made to individuals state that the agency has no indication that their data was involved in fraud.