An apparent large data breach occurred in the past few months in the files of the Oklahoma Tax Commission and notifications were sent out this week to those whose files might have been targeted.
The Tax Commission started notifications just this past week but the breach was discovered in December of last year.
Those who received the notification in the form of a letter were told, “In December 2025, the OTC learned of suspicious activity within the Oklahoma Taxpayer Access Point system.
“In response, the OTC promptly launched an investigation into the suspicious activity with the assistance of third-party cybersecurity and digital forensic specialists,” stated the notification.
“The OTC’s Investigation determined there was unauthorized access to W-2 and 1099 files within the OkTAP system between September 18, 2025—December 20, 2025.”
The agency told recipients of the notification that “at this time, the OTC does not have any indication that the information has been used to commit identity theft or fraud in relation to this incident.”
It did not explain why the Tax Commission waited until late March to start notifications. It is also not clear how many individuals might have been targeted in the breach. But apparently, it involved more than state employees.
Late Wednesday, the Tax Commission issued a release regarding the breach.
The Oklahoma Tax Commission (“OTC”) takes the protection of taxpayer information very seriously and information privacy and security are among the OTC’s highest priorities. Working with the IRS, in December 2025, the OTC learned of suspicious activity within its Oklahoma Taxpayer Access Point (“OkTAP”) system. In response, the OTC promptly launched an investigation with the assistance of third-party cybersecurity and digital forensic specialists.
Through the investigation, the OTC learned that the event involved taxpayer information. We cannot speak to the total number of individuals involved; however, impacted individuals have been notified directly by mail with details regarding the event and information about complimentary credit monitoring and fraud assistance services the OTC made available to them.
Additionally, the OTC has implemented several additional security measures to prevent this event from occurring in the future. The OTC sincerely regrets any concern this incident may cause and remains committed to strong safeguards and protecting the information entrusted to the agency.