Oklahoma’s New Cybersecurity Breach Law Reveals Gaps in Reporting as Attacks Surge Oklahoma’s Security Breach Notification Act, enacted in 2025, requires businesses, schools, and state agencies to report cyberattacks exposing the personal data of at least 500 Oklahomans to the Attorney General’s Office. The law also mandates "reasonable safeguards" to protect sensitive information, with civil penalties for non-compliance. As of July 30, only three entities Jenks Public Schools, Gordon Cooper Technology Center, and the University of Phoenix had formally reported breaches under the new statute. The University of Phoenix disclosed a November 2025 breach, predating the law, in which hackers accessed student data, including bank account numbers, via a third-party software vulnerability. Meanwhile, Jenks Public Schools and Gordon Cooper Technology Center reported an April attack on the Canvas learning platform by the hacking group ShinyHunters, which claimed to have compromised data from over 275 million individuals across nearly 9,000 schools globally, including dozens in Oklahoma. Despite these reports, cybersecurity experts suspect underreporting. Ron Vaughn of Emsco Solution identified at least 17 cyberattacks in Oklahoma this year based on public records, suggesting many incidents may have gone unreported. The FBI’s 2025 Internet Crime Complaint Center report noted a 26% increase in cybercrime-related losses, totaling nearly $21 billion for U.S. residents, with threats expected to escalate alongside advancements in artificial intelligence. Recent incidents highlight the law’s challenges. In August, the city of Coweta disclosed a ransomware attack but did not specify the demanded amount. The Oklahoma Tax Commission’s April breach, which exposed personal data through the OKTAP tax portal, was also not reported to the Attorney General. Similarly, the Oklahoma Manufacturing Alliance (OMA) suffered a July ransomware attack by the Booba Project group, which threatened to publish or auction stolen data. OMA did not report the incident, citing no exposure of personal client information, though it acknowledged the attack as a reminder of cybersecurity’s critical role. The law, backed by bipartisan support, aims to centralize breach reporting for better threat tracking. However, critics like Sen. David Bullard (R-Durant) argued it could unfairly penalize businesses for security lapses. Co-author Sen. Brent Howard (R-Altus) countered that the goal was not punishment but establishing a system to identify industry-wide vulnerabilities. Oklahoma joins over half of U.S. states with similar "reasonable security" requirements, reflecting a growing national effort to address escalating cyber threats.