Travel Oklahoma travelok.com Travel Oklahoma data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In December 2020, the Oklahoma Tourism and Recreation Department's TravelOK site was breached. Have I Been Pwned lists 637,279 accounts with email addresses, names, physical addresses, dates of birth, genders and age groups. Passwords weren't listed.
View all 13,118 breaches- Breach date
- 17 Dec 2020
- Affected
- 637,279
- Data exposed
- Age groups, Dates of birth, Email addresses, Genders, Names, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
TravelOK is the website of the Oklahoma Tourism and Recreation Department, where people order travel brochures and enter contests. In December 2020, an outsider got hold of data from the site and its related websites. The department reported the breach publicly in early 2021 and a local news headline said no Social Security or financial data was compromised. Have I Been Pwned (HIBP) added the data to its database in March 2021.
HIBP lists 637,279 accounts. It says the incident exposed 637k email addresses across several tables, including age ranges tied to brochure orders and dates of birth tied to contest entries.
Sources checked: haveibeenpwned.com, tulsaworld.com
Last verified against the official page:
What was exposed
The data included email addresses, names, physical addresses, dates of birth, genders and age groups. HIBP doesn't list passwords or payment details for this breach.
What it lets criminals do
Nobody can empty a bank account with a brochure order. The risk is quieter. An email address, a home address and a date of birth together make a believable profile, and scammers use that kind of profile for targeted phishing and for building fake identities. Expect messages that sound like a travel, tourism or prize offer, since the data came from brochure orders and contest entries.
What to do
Because identity details but no passwords were involved, the priority is spotting scams rather than changing logins. The steps below are ordered that way.
What to do if you were in it
- 1
Expect phishing that mentions the breach
With your email, home address and date of birth out, scammers can write emails and texts that look personal. Don't click links in unexpected messages. Go to the company's site yourself.
- 2
Be wary of prize and travel offers
The data came from brochure orders and contest entries. A message saying you won something or that a booking needs confirming is a classic follow-up scam.
- 3
Watch for misuse of your date of birth
A date of birth plus a name and address helps with account recovery tricks. Turn on two-factor login for your email and banking so a guessed answer isn't enough.
- 4
Consider a credit freeze
Birth dates are used in credit applications. A free freeze at Equifax, Experian and TransUnion blocks most new accounts in your name, and you can lift it whenever you need credit.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email and phone number, and Serus keeps monitoring and alerts you when your details turn up in a new leak.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Travel Oklahoma breach?
If you ordered brochures or entered contests on TravelOK around 2020, you may be. Look up your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, names, physical addresses, dates of birth, genders and age groups, according to HIBP.
Was my password or card exposed?
HIBP doesn't list passwords or payment data for this breach.
Should I change my password?
Not because of this breach alone. If you reuse passwords, change them and turn on two-factor login anyway.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
