My social and credit cards just got hacked because of the state of South Carolina

[Easy Mac]

Are you kidding me?

Hackers access most SC Social Security numbers | South Carolina News - WYFF Home

The Social Security numbers of a majority South Carolina residents have been exposed in a cyber attack, along with 387,000 credit and debit card numbers, according to the S.C. Department of Revenue.

The S.C. Department of Revenue announced Friday that approximately 3.6 million Social Security numbers have been exposed.

Of the 387,000 credit cards, the vast majority are protected by strong encryption deemed sufficient under the demanding credit card industry standards to protect the data and cardholders, according to the SCDR. But about 16,000 were unencrypted.

To protect taxpayers, the state will provide those affected with one year of credit monitoring and identity theft protection. Officials emphasized that no public funds were accessed or put at risk.

“On Oct. 10, the S.C. Division of Information Technology informed the S.C. Department of Revenue of a potential cyber attack involving the personal information of taxpayers,” said DOR Director James Etter. “We worked with them throughout that day to determine what may have happened and what steps to take to address the situation. We also immediately began consultations with state and federal law enforcement agencies and briefed the governor’s office.”

Upon the recommendation of law enforcement officials, DOR contracted Mandiant, one of the world’s top information security companies, to assist in the investigation, help secure the system, install new equipment and software and institute tighter controls on access.

The SCDR said that on Oct. 16, investigators uncovered two attempts to probe the system in early September, and later learned that a previous attempt was made in late August. In mid-September, two other intrusions occurred, and to the best of the department’s knowledge, the hacker obtained data for the first time. No other intrusions have been uncovered at this time. On Saturday, the vulnerability in the system was closed and, to the best of the department’s knowledge, secured.

“The number of records breached requires an unprecedented, large-scale response by the Department of Revenue, the State of South Carolina and all our citizens,” said Governor Nikki Haley. “We are taking immediate steps to protect the taxpayers of South Carolina, including providing one year of credit monitoring and identity protection to those affected.”

Anyone who has filed a South Carolina tax return since 1998 is urged to visit protectmyid.com/scdor or call 1- 866-578-5422 to determine if their information is affected. If so, the taxpayer can immediately enroll in one year of identity protection service provided by Experian.

Experian’s ProtectMyID™ Alert is designed to detect, protect and resolve potential identity theft, and includes daily monitoring of all three credit bureaus. The alerts and daily monitoring services are provided for one year, and consumers will continue to have access to fraud resolution agents and services beyond the first year.



Read more: Hackers access most SC Social Security numbers | South Carolina News - WYFF Home

So my reward is that I get to enroll in a year of identity theft protection, which I'm sure if I enroll in, I get automatically renewed, unless I remember to cancel.

I hate this state so much.

[DaddyTorgo]

You should sue.

[JediKooter]

Good thing they told you 16 days later...

[Easy Mac]

They had to wait to Friday afternoon. That's when you drop all the important news.

[sterlingice]

I like how it's also incumbent on the victim, not the negligent party to see if they're affected

SI

[sterlingice]

There's always this:

The Daily Show with Jon Stewart
Get More: Daily Show Full Episodes,Political Humor & Satire Blog,The Daily Show on Facebook

Of course, I can't even remember if that's the best one because there's been so much out of South Carolina that it's been a favorite of the Daily Show

SI

[QuikSand]

At least you can drown your sorrows in ten or fifteen of those ludicrous little bottles of booze.




(yes, I know you did away with that six weeks ago or something)

[SunDevil]

South Carolina Department of Revenue Hacked, 3.6 Million SSNs Taken - Slashdot

From this article they are saying the breaches happened in August and September but only realized it in October.

The first they're aware of happened on August 27, and four more happened in September. Officials first learned of the breach on October 10, and the security holes were closed on October 20

[Surtt]

Has anyone tried to find out if they were affected?

the link redirects me to a Experian sign up page and asks for an activation code.
When I call the number it tells me to call back later

[Thomkal]

well that's just lovely-can't wait to see if my family and I are affected.

[Easy Mac]

You should get used to waiting. They don't work weekends. I'm sure this is no time for politics, but fuck these backwoods republican hicks who run this state.

[Thomkal]

Originally Posted by Easy Mac

You should get used to waiting. They don't work weekends. I'm sure this is no time for politics, but fuck these backwoods republican hicks who run this state.

Actually there are weekend hours to find out if you are affected/enroll in the protection program:

http://www.sctax.org/security.htm

[Surtt]

Originally Posted by Surtt

Has anyone tried to find out if they were affected?

the link redirects me to a Experian sign up page and asks for an activation code.
When I call the number it tells me to call back later

After some googling this statment is wrong....

Anyone who has filed a South Carolina tax return since 1998 is urged to visit protectmyid.com/scdor or call 1- 866-578-5422 to determine if their information is affected. If so, the taxpayer can immediately enroll in one year of identity protection service provided by Experian.

It appears you need to call, get a code from them, and then go sign up on the web site.

There is no "or visit protectmyid.com/scdor", you need to call.
Going from my previous experiences with the state of SC, I expect it to be after the New Years before I get though.

[Easy Mac]

Then the need to update their phones, because it says they're only open weekdays.

[Ben E Lou]

Originally Posted by Surtt

When I call the number it tells me to call back later

Yeah. Same here. Lovely.

[bhlloy]

So as previously noted, the credit score companies get a huge bump out of this (how many of these people are going to forget about this and get auto-renewed or just aren't going to want to deal with the predatory sales people when they call to cancel)

Seems like at best a pretty inadequate and opportunistic response and at worst, well there's a number of scenarios that come to mind. Putting my crazy conspiracy theory hat on for a second.

[molson]

I would assume they wouldn't ask you for your credit card info for to get the credit monitoring service so there's no auto-renewal billing, you just need the activation code, which is something you can get from banks sometimes when you start a new account. I mean, otherwise, it's just a free trial, you can get that anywhere, you don't need south carolina or an activation code for that.

Though it would be kind of funny if South Carolina is pushing everyone towards a particular company's trial to give them their credit card numbers, but I doubt they'd stoop that low. They're incompetent, sure, but that's not even subtle.

[Radii]

Equifax Online Help: How to Set a Fraud Alert

A Fraud Alert is free, as the Equifax info says normally you need a police report for an "extended" fraud alert, I don't know if this SC thing is going to be an exception.

How to Freeze Your Credit - Equifax Credit Security Freeze

I never used the security freeze stuff, it sounded to me like it was going to make it a giant pain in the ass the next time I wanted credit myself.

Get your FICO score and credit report with Equifax's Credit Score Watch

I used this service for a few years after my ID Theft mess. I don't anymore, but when I did I always felt it was worth the money. I only used one for Equifax instead of trying to find something for all three. I wasn't paying $14.95/mo either, always some deal to lower that cost.

[Ben E Lou]

This thing is kinda weird. I got a very generic activation code. My wife called back 10 minutes later and got the same code.

[Thomkal]

Originally Posted by Ben E Lou

This thing is kinda weird. I got a very generic activation code. My wife called back 10 minutes later and got the same code.

Yeah that is weird. I haven't called yet, but I'd be curious to see if anyone else here got the same code as you and your wife.

[Thomkal]

Oh and when you call do they tell you if you are one of the people definitely affected or not?

[Easy Mac]

I get through, select an option, then it tells me do to overwhelming demand, they can't accept my call, and to call again later. Then how did I connect in the first place?

[sterlingice]

Back when a laptop got stolen from Bank of America or something like that about 4 years ago, I got a letter in the mail with a number to call.

It seemed like their remedy for losing said laptop was to buy credit reporting in bulk for those affected for a year and that was our "compensation".

That said, seems like a good phishing exercise, too. If everyone knows the numbers were stolen, what's to stop malicious folks from trying to do scams?

SI

[Easy Mac]

Finally got generic activation code. It looks like you sign up regardless. Doesn't appear to be specific to identify if you are affected.

[Easy Mac]

so my SC people, have they said anything more about any of this? If I'm not mistaken, it said if you went to the website, it would tell you if your number got leaked, but that information is nowhere. And the phone number definitely did not provide any information.

I assume lawmakers are hoping we just forget all about it, what with the massive hurricane and Lattimore's knee.

[Ben E Lou]

Dear South Carolina Taxpayer:

As you know, tax data at the South Carolina Department of Revenue (SCDOR) was compromised due to a recent security breach. Immediately upon discovering the data breach, new technology and policy protections were implemented at SCDOR to prevent further information exposure. We are writing you today to confirm that your tax information was compromised. The tax information that was compromised includes social security numbers of you and your dependents, if you claimed dependents on a tax return, and your bank account number only if you provided a bank account number on your electronic return(s). If your bank account number was compromised, you should regularly review your monthly bank account statement and your account online, and contact your bank immediately if you see any unexplained charges.

In addition to the Experian® ProtectMyID® services in which you have enrolled, we want to remind you that SCDOR is providing protection services for your minor dependents under Experian's Family Secure® program. You should receive a notification from Experian about how to enroll in Family Secure within a few days of enrolling in ProtectMyID. The enrollment period for Family Secure ends May 31, 2013. More valuable information on protecting yourself and your family is available from the Department of Consumer Affairs by visiting www.consumer.sc.gov and clicking the "Identity Theft Resources" button or calling 1-800-922-1594.

Two additional protections that will alert you to the opening of new credit files or prevent them from being opened are fraud alerts and security freezes:

You can place a fraud alert at one of the three major credit bureaus by phone and also via Experian's website. A fraud alert tells creditors to follow certain procedures, including contacting you, before they open any new accounts or change your existing accounts. For that reason, placing a fraud alert can protect you, but also may delay you when you seek to obtain credit. The contact information for all three bureaus is as follows:


Equifax® Fraud Reporting
1-800-525-6285
P.O. Box 740241
Atlanta, GA 30374-0241
Credit Reports, Credit Scores, Identity Theft Protection from Equifax

Experian® Fraud Reporting
1-888-397-3742
P.O. Box 9532
Allen, TX 75013
Credit Report and Credit Score with Toll-Free Support from Experian

TransUnion® Fraud Reporting
1-800-680-7289
Fraud Victim Assistance Division
P.O. Box 6790
Fullerton, CA 92834-6790
www.transunion.com


It is necessary to contact only ONE of these bureaus. As soon as one of the three bureaus confirms your fraud alert, the others are notified to place alerts on their records as well. You will receive confirmation letters in the mail from all three bureaus and will then be able to order all three credit reports, free of charge, for your review.

A stronger preventative step is to place a security freeze on your financial information. You can place, lift, or permanently remove the security freeze free of charge in South Carolina. When you place a freeze, if someone acquires your personal information he/she will not be able to open new accounts or borrow money in your name. You will need to contact ALL THREE credit bureaus to place the freeze. Keep in mind that you will not be able to borrow money or get instant credit, new credit cards, insurance, cell phone service or other utilities until you temporarily lift or permanently remove the freeze, and that a freeze cannot be placed for children unless a credit file has been opened on them (which is usually a sign of fraud). Contact information for all three credit bureaus is:


Equifax® Security Freeze
P.O. Box 105788
Atlanta, GA 30348
1-800-685-1111
www.freeze.equifax.com

Experian® Security Freeze
P.O. Box 9554
Allen, TX 75013
1-888-397-3742
Experian - Security Freeze Center

TransUnion® LLC
P.O. Box 6790
Fullerton, CA 92834-6790
1-888-909-8872
http://freeze.transunion.com


We have been informing the public about the incident and how to protect yourself and your families in press conferences and newspapers, on TV and on the internet starting the moment law enforcement gave us permission to do so, and be assured that we will continue to do so. Again, for more information on protecting yourself against identity theft, please contact the Department of Consumer Affairs at1-800-922-1594 or visit www.consumer.sc.gov. For more information on the incident, visit www.sctax.org/security.

Woohoo

[Toddzilla]

Someone got ahold of my credit card and bank account information.

But I'm such a deadbeat, it actually raised my credit score...

[molson]

"Again, for more information on protecting yourself against identity theft, please contact the Department of Consumer Affairs"

Tip #1 - avoid dangerous and reckless activities like filing tax returns in South Carolina.

[stevew]

Originally Posted by QuikSand

At least you can drown your sorrows in ten or fifteen of those ludicrous little bottles of booze.




(yes, I know you did away with that six weeks ago or something)

Just saw this...awesome.

[stevew]

The troubling thing is that they have your info and once it's out there, it's out there forever. Outside of issuing a new SSN, which probably should happen, what's to say that you won't get hacked in 20 years. So dumb, and so preventable.