Breach Disclosure: Oklahoma Tourism and Recreation Department

In December 2020, the Oklahoma Tourism and Recreation Department was breached, resulting in the exposure of 637,000 email addresses. An unknown individual had originally contacted the Oklahoma organization stating that they had stolen data from the website TravelOK[.]com, in addition to travel related websites for the state. In addition to including email addresses, the breach data also includes first and last names, addresses, phone numbers, birthdays, and hashed passwords.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

While originally attributed to an unknown individual by the Oklahoma Tourism and Recreation Department, the user 'pompompurin' on RaidForums, stated that had breached the website. This user has been responsible for a large number of breaches recently, however, the leaker requested attribution to 'badhou3a' when releasing this data to HaveIBeenPwned. It is not verified at this time who is ultimately responsible for this breach, however, the user 'pompompurin' had released this with evidence on RaidForums, as opposed to a request for attribution in HaveIBeenPwned.

Figure 1: Sample of travelok.sql database

Figure 2: Breach advertisement on RaidForums