HackingCustomer Data InvolvedDelayed DiscoveryIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
Oklahoma Tax Commission
bd_9761396221115132 · schema v1 · pii pii-v1
Full breach record for Oklahoma Tax Commission →The Oklahoma Tax Commission (OTC) notified individuals that unauthorized access occurred to W-2 and 1099 files in the OkTAP system between July 5, 2024, and December 20, 2025. The OTC learned of suspicious activity in December 2025. Affected data includes names and Social Security numbers. The OTC engaged third-party forensic specialists, cooperated with the IRS, and implemented additional safeguards. Credit monitoring is offered.
California clockDiscovered Dec 1, 2025 → Notified Mar 27, 2026116d ✗ CA 60-day late17 weeks discovery → filing
This filing is one of 6 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (5) · sorted by filing gap
- bd_106ec023e6c2444aMaine State AGfiled 2026-03-27Candidate
- bd_59f67e4c69e02380New Hampshire State AGfiled 2026-03-27Verified
- bd_c855c9473a93d594Indiana State AGfiled 2026-03-27Verified
- bd_d4fd04889cc15d7cVermont State AGfiled 2026-03-27Candidate
Show 1 more filing ↓Show fewer ↑up to 3d gap
- bd_1009fe78a84233d0Texas State AGfiled 2026-03-30(3d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-620935
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Mar 27, 2026
- Raw hash
- 945df45586e9fea94a5583565bddd71acadeef6e675d8f933a1d53b302fa67e2
Reporting entity
- Name
- Oklahoma Tax Commissionnorm: oklahoma tax commission
- Domain
- tax.ok.gov
Victim entity
- Name
- Oklahoma Tax Commissionnorm: oklahoma tax commission
- Domain
- tax.ok.gov
Incident
- Discovered
- Dec 1, 2025
- Materiality determined
- —
- Notification sent
- Mar 27, 2026
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unknown
- MITRE ATT&CK
- T1078 Valid Accounts
- Threat actor
- External
- Regulator citations
- Cooperating with the Internal Revenue Service (“IRS”) to further its investigation so it can monitor fraudulent tax filing activity
Compliance
- Time to disclose
- 17 weeks(116 days from discovery to filing)
- Compliance flags
- CA 60-day late · 116dCA AG copy ≤15d · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Dec 1, 2025→ Notified: Mar 27, 2026116d 60 days (analyst band, pre-2026 discoveries) CA 60-day late California Consumers notified: Mar 27, 2026→ AG copy submitted: Mar 27, 20260d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.