Travel Oklahoma travelok.com Travel Oklahoma data breach: what happened and what to do
In December 2020, the Oklahoma Tourism and Recreation Department's TravelOK site was breached. Have I Been Pwned lists 637,279 accounts with email addresses, names, physical addresses, dates of birth, genders and age groups. Passwords weren't listed.
View all 13,177 breaches- Breach date
- 17 Dec 2020
- Affected
- 637,279
- Data exposed
- Age groups, Dates of birth, Email addresses, Genders, Names, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
TravelOK is the website of the Oklahoma Tourism and Recreation Department. People use it to order travel brochures and enter contests. In December 2020, an outsider got hold of data from the site and its related websites. The department reported the breach in early 2021, and a local news headline said no Social Security or financial data was compromised. Have I Been Pwned (HIBP) added the data in March 2021.
HIBP lists 637,279 accounts. It says the data came from several tables, including age ranges tied to brochure orders and dates of birth tied to contest entries.
Sources checked: haveibeenpwned.com, tulsaworld.com
Last verified against the official page:
What was exposed
Email addresses, names, physical addresses, dates of birth, genders and age groups. HIBP doesn't list passwords or payment details for this breach.
What it lets criminals do
Nobody can empty a bank account with a brochure order, so the risk here is quieter. A name, an email, a home address and a date of birth together make a believable profile. Scammers use profiles like that for targeted phishing and to build fake identities. Since the data came from brochure orders and contest entries, expect messages about a trip, a tourism deal or a prize you supposedly won.
What to do
No passwords were involved, so the priority is spotting scams, not changing logins. The steps below are in that order.
What to do if you were in it
- 1
Expect phishing that mentions the breach
With your email, home address and date of birth out, scammers can write emails and texts that look personal. Don't click links in unexpected messages. Go to the company's site yourself.
- 2
Be wary of prize and travel offers
The data came from brochure orders and contest entries. A message saying you won something, or that a booking needs confirming, is a classic follow-up scam.
- 3
Watch for misuse of your date of birth
A date of birth plus a name and address helps with account recovery tricks. Turn on two-factor login for your email and banking so a guessed answer isn't enough.
- 4
Consider a credit freeze
Birth dates are used in credit applications. A free freeze at Equifax, Experian and TransUnion blocks most new accounts in your name, and you can lift it whenever you need credit.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number, and Serus keeps monitoring and alerts you when your details turn up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Travel Oklahoma breach?
If you ordered brochures or entered contests on TravelOK around 2020, you may be. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, names, physical addresses, dates of birth, genders and age groups, according to HIBP.
Was my password or card exposed?
HIBP doesn't list passwords or payment data for this breach.
Should I change my password?
Not because of this breach alone. If you reuse passwords, change them and turn on two-factor login anyway.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
What changed
- Page text rewritten to be clearer; facts and sources unchanged.
