Dear OSEA Members,
The Oklahoma Tax Commission (OTC) has confirmed a significant data security incident involving its online taxpayer portal, the Oklahoma Taxpayer Access Point (OkTAP) system. Many of your clients may receive or have already received notification letters, and this breach could impact tax filing security and identity protection efforts.
Incident Summary
- Unauthorized Access: Third parties gained access to certain W-2 and 1099 files stored in the OkTAP system.
- Timeframe: July 5, 2024, through December 20, 2025 (some letters reference September 18, 2025 – December 20, 2025).
- Data Exposed: Names and Social Security Numbers (SSNs) from the affected files. No additional financial account information was specified in official disclosures.
- Discovery: Suspicious activity was detected in December 2025 in coordination with the IRS. A full forensic investigation followed, with the breach formally documented on March 10, 2026.
- Notifications: Personalized letters dated March 27, 2026, were mailed to impacted individuals. The total number of affected taxpayers has not been publicly disclosed, but notifications have gone to Oklahoma residents and at least some out-of-state individuals.
OTC’s Actions
The agency cooperated with the IRS to monitor for fraudulent filings, reviewed its security standards, and implemented additional safeguards in the OkTAP system. Affected individuals are being offered 12 months of complimentary single-bureau credit monitoring and fraud assistance through Cyberscout (a TransUnion company).
Guidance for Enrolled Agents and Your Clients
As tax professionals, we play a key role in helping clients navigate this situation. Recommend the following proactive steps:
- File 2025 Returns Promptly — Encourage clients to file as soon as possible (if not already filed) to reduce the risk of fraudulent returns being submitted using their information.
- IRS Identity Protection PIN (IP PIN) — Strongly consider helping clients apply for an IP PIN for enhanced protection on current and future filings.
- Credit Monitoring — Advise clients who received a letter to enroll immediately in the free 12-month credit monitoring service using the activation code provided.
-
Ongoing Monitoring:
- Review bank, credit card, and IRS account statements regularly.
- Pull free annual credit reports at AnnualCreditReport.com.
- Consider a credit freeze or fraud alert with the major bureaus if additional protection is desired.
- Vigilance Against Scams — Warn clients to be wary of phishing emails, calls, or texts purporting to be from the IRS, OTC, or related to this breach.
How OSEA Members Can Assist Clients
- Review any notification letters clients bring to you and provide personalized guidance.
- Assist with IP PIN applications and secure tax preparation practices.
- Remind clients of your office’s commitment to data security and confidentiality.
This incident underscores the ongoing risks to taxpayer data in state systems and the value of professional representation. OSEA will continue monitoring developments and will share updates as more information becomes available.
If you have clients who received letters or have questions about this breach, feel free to share experiences (without disclosing confidential details) with fellow members via our forums or upcoming meetings.
Stay informed and continue providing excellent service to your clients during this tax season.
Best regards,
Edward M. Moore, EA
President - Oklahoma Society of Enrolled Agents
