The Oklahoma Tax Commission (OTC) has notified affected taxpayers that it discovered suspicious activity within its Oklahoma Taxpayer Access Point (OkTAP) system in December 2025. After launching an investigation with third-party cybersecurity and digital forensic specialists, the OTC determined that someone gained unauthorized access to certain W-2 and 1099 files stored in the system between July 5, 2024 and December 20, 2025. A review of those files confirmed that information belonging to the notified individuals was included.
The letter is addressed to taxpayers whose W-2 or 1099 files were part of the files accessed in the OkTAP system during that window. The OTC has not stated a total number of people affected in the portion of the notice provided, but it has confirmed your name and Social Security number specifically were included in the exposed files.
What information was exposed?
- Full name
- Social Security number
As a precaution, the OTC is offering twelve months of complimentary single-bureau credit monitoring and fraud assistance through Cyberscout, a TransUnion company. You can enroll at https://bfs.cyberscout.com/activate using the unique code included in your individual letter, and you must do so within 90 days from the date of the letter (dated March 27, 2026).
What should you do now?
- Enroll in the free credit monitoring offered by the OTC before the 90-day deadline, since Social Security numbers were involved.
- File your 2025 tax return as soon as possible, since exposed SSNs can be used to file fraudulent returns in your name — the IRS Identity Theft Affidavit (Form 14039) is available if you suspect this has already happened.
- Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion, since a Social Security number combined with your name can be used to open new credit accounts.
- Request your free annual credit reports at annualcreditreport.com and review them closely for accounts you don’t recognize.
- Consider signing up for a service like Aura or LifeLock, which can alert you if your information appears elsewhere, such as being sold or traded online.
- Watch for IRS or state tax notices about returns you didn’t file, and report any suspected identity theft to the FTC at identitytheft.gov.
- Keep the breach letter and any enrollment confirmation in case you need to prove you were affected later.