Oklahoma Department of Securities securities.ok.gov

Oklahoma Department of Securities data breach: what happened and what to do

A misconfigured firewall left a server at the Oklahoma Department of Securities reachable from the internet in late 2018. The state's notice says up to 305,746 people were affected, with names, dates of birth, Social Security numbers and financial account numbers exposed.

View all 13,177 breaches

Breach date: 29 Nov 2018
Made public: 10 May 2019
Affected: 305,746
Data exposed: Names, Dates of birth, Social security numbers, Financial account numbers
Last updated: 25 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

The Oklahoma Department of Securities is the state regulator for investments. Its notice says a vulnerability in its firewall made a server accessible around December 11, 2018. A Hawaii consumer protection filing from the department's law firm says it reported the matter to the FBI in January 2019. On or about February 14, 2019, it determined that the server was accessible and that the information on it was potentially affected. Some press coverage dates the exposure from November 29, 2018 and credits the security firm UpGuard with finding it.

The state's cybersecurity breach page says the information of as many as 305,746 people was affected.

Sources checked: oklahoma.gov, cca.hawaii.gov, itwire.com

Last verified against the official page: 25 Oct 2026

How we research this Report an error

What was exposed

According to the notice, the exposed data included names, dates of birth, Social Security numbers and financial account numbers. The department said it had no evidence of actual fraudulent misuse of the information.

That combination is what identity thieves look for. A date of birth plus a Social Security number can be used to apply for loans and cards, and a financial account number points a scammer at your bank. Because the data came from a securities regulator, people with investment dealings in Oklahoma should be extra careful about messages that claim to come from a broker or a regulator.

The company's response

The department notified affected people and reportedly offered 12 months of identity theft monitoring. A class action lawsuit was filed against it over the incident, alleging negligence in configuring the firewall. A lawsuit's allegations are claims, not findings.

What this means for you

If you got a letter, take the credit monitoring offer if you want it, and freeze your credit as well. The two do different things: monitoring tells you after something happens, while a freeze blocks most new accounts.

What to do if you were in it

1

Freeze your credit at all three bureaus

A freeze is free and stops most new accounts being opened in your name. Place it separately at Equifax, Experian and TransUnion, as the FTC explains. Lift it when you apply for credit yourself.
2

Read your statements and explanation of benefits

Look for charges, accounts or medical services you don't recognize, and report anything odd to the company that sent it.
3

Expect messages that mention the breach

Scammers write to affected people with real details to sound credible. Don't click links in unexpected emails or texts. Go to the company's own site or the phone number on your card.
4

Report misuse

If someone uses your details, report it at IdentityTheft.gov to get a recovery plan.
5

Check whether your email or phone is in this and other breaches

A free Serus scan checks breach databases for your email, phone and other details and alerts you when they appear in a new leak.