UPDATE: Millions of SC Residents' Social Security Numbers Stolen
In addition to Social Security numbers, personal financial information also exposed in massive hacking plot, officials say.
“This is not a good day for South Carolina,” is how Gov. Nikki Haley began a Friday afternoon press conference with other state officials at SLED offices in Columbia.
“The state of South Carolina has come under attack by an international hacker,” Haley said before explaining that 3.6 million Social Security numbers had been stolen and 387,000 credit/debit cards were exposed when a vast database maintained by the SC Department of Revenue was hacked into.
Watch the video of Haley's press conference HERE.
Haley would not go so far as to call the security breach an act of terrorism, but did say it was international in nature. She did little to conceal her anger, saying she’d like the perpetrator(s) “slammed against a wall” or that she’d like to “kick him.”
Also at the press conference were SLED Chief Mark Keel, Mike Williams of the United States Secret Service, Jim Etter, Director of the South Carolina Department of Revenue (DOR) and Inspector General Patrick Maley.
Earlier in the day, WLTX reported the security breach but Haley said that report had nothing to do with timing of announcement, which came more than two weeks after officials realized a breach had occurred.
Williams said the Secret Service learned of the breach on Oct. 10 and began informing the state’s 16 agencies. Williams explained that officials could not go public with the breach because it had to achieve a number of “benchmarks” before doing so. Williams was not at liberty to explain what those benchmarks are.
Keel said the banking industry was secretly notified at the beginning of the investigation as required by state law, according to a Greenville News report Friday. The law also requires the public who are at risk to be notified. Keel told the paper investigators didn’t know throughout the investigation if the data had been compromised.
The breach and data theft was reportedly discovered by the U.S. Secret Service on Oct. 10, officials said, but the first intrusion began in August. The data was stolen in September, officials told the paper.
Reportedly, none of the Social Security numbers were encrypted and officials said they are studying whether they can do that. However, said the paper, all but 16,000 credit card numbers were encrypted, a process designed to thwart identity thieves and data theft.
View a chronology of the security breach HERE.
Ironically, from the time the breach occurred to the time it was announced, Haley completed a review of nine state agencies and found them “in...compliance with sound computer security practices" according to WLTX.
In response to the attack, Haley issued an executive order mandating a review of the information security systems of all of the state’s agencies (see attached).
Due to the investigation’s status as ongoing, Williams and Keel also could not say if the hacker had targeted South Carolina specifically or if it was part of a larger plot. The officials also would not say if the hacker was an individual or a group, though Haley referred to the hacker as “him” throughout the press conference.
The state also created a helpline (1-866-578-5422) and website (protectmyid.com/scdor) for residents. Anyone who has paid taxes in the state of South Carolina since 1998 is urged to call the phone number. After calling the number, anyone affected by the breach will be given a code to enter upon visiting the website.
The state will provide those affected with one year of credit monitoring and identify-theft protection free of charge. The cost for this was not provided.
The breach, which was described by Williams as among the largest he’d seen, comes on the heels of several other cracks in the cyber security wall in the past year, one of which occurred when a state employee transferred confidential Medicaid data to his personal email account last April. And in August more than 30,000 University of South Carolina students had their confidential information compromised by an overseas hacker.
Officials said they do not believe this attack is related to any previous ones.
Nancy Davis
1:38 pm on Friday, October 26, 2012
The 1-866 number above does not work. Any suggestions?
Sharron Hodorovic
6:33 pm on Friday, October 26, 2012
And for all the people, they give you one measley number of all things! And people don't forget, the Governor's SSN's can very well be in there with the rest of ours!
Geez, what a way to start the weekend!
Grits N Grace
1:41 pm on Friday, October 26, 2012
The website asks for an activation code too!!! I'm thinking this is a scam, too!!!!
Hal Millard
1:41 pm on Friday, October 26, 2012
Thanks for that information. I will check it out and try to correct.
RyanH
2:37 pm on Friday, October 26, 2012
The original story says this: you are urged call 1-866-578-5422 to get an activation code to use here: www.protectmyid.com/scdor to see if your information has been compromised. So you have to call first; visiting the site first does nothing.
Hal Millard
1:44 pm on Friday, October 26, 2012
The number worked for me. Anyway... We have a Patch reporter in Columbia en route to the Haley/SLED press conference. I would expect many more details on how to resolve issues to come out of it. If so, we will report them immediately on this site. So stay tuned.
Addison
2:12 pm on Friday, October 26, 2012
When I go to the web site, it wants an activation code, which is not provided in the articel, so I am not sure what you mean when you say it works for you. Did you somehow get an activation code that was left out of the article?
Patrick Goodwin
1:45 pm on Friday, October 26, 2012
so does this mean if you filed taxes ...then your bank info got taken ?..been on hold at this number for awhile ...i hope they don't want ss#'s ...that ain;t gonna happen
Eugene
1:45 pm on Friday, October 26, 2012
1866 number puts you in never ending hold queue.
Anon
1:46 pm on Friday, October 26, 2012
It might help to have the redemption code!!!!
MaryMargaret Dobson
1:51 pm on Friday, October 26, 2012
Clicked through to http://www.protectmyid.com/scdor which goes to Experian and requires a code to activate?
Laura
1:52 pm on Friday, October 26, 2012
Great! First the Federal government gives out my social security info. (VA) Now the state does the same! Why did they wait till now to take steps to protect us? Why did they not learn from the VA files? They offer protection for one year, but what happenes 5 years from now if your information is used? Are they going to protect you then? Who will be responsible. I think any federal or state agency that is responsible for the breach of their computers or information should be held accountable as long as the person who's info. was taken is living. We the citizens need to make them protect us!
Ken
1:52 pm on Friday, October 26, 2012
Nice, the link to the web address is nothing more than a link to an advertisement for a credit protection service that requires an activation code. Thank you S.C.
Lady Godiva
1:58 pm on Friday, October 26, 2012
Waiting on hold endlessly to get a redemption code that should have been supplied in the first place. SC sure knows how to add insult to injury.
Patrick Goodwin
1:58 pm on Friday, October 26, 2012
I just got off the phone with the site....they said it is too early to tell exactly who got hacked ...they said anyone efffected will get a notice from the state and will be offered the credit monitoring service for a yr....or call the number next week when they have more info....that's all I got from them
Lady Godiva
2:00 pm on Friday, October 26, 2012
Thanks for the info, Patrick. I will get off the phone now and pray my SS and CC haven't been hacked.
Hal Millard
2:04 pm on Friday, October 26, 2012
I have passed along your concerns and complaints to our Columbia reporter now on the story. Hopefully, it can be figured out. I suspect thet website and tollfree number may just be a CYA move on the part of the state. I'd like the information, because I'm affected too!
RyanH
2:46 pm on Friday, October 26, 2012
I also just talked to my credit union, and they gave me the same phone number to call. At least they're aware of what's happening though it appears that by law they've known for a while. Other than that and an assurance that my funds are NCUA-insured in case someone empties the account, they basically just gave me a virtual shoulder shrug and told me to keep a close eye on my accounts. Not terribly reassuring.
Sammy
2:05 pm on Friday, October 26, 2012
When I call the number I get a message saying that all circuits are busy. And the link take me to a site where I am supposed to pay money. Bummer.
judidth h. ellington
2:18 pm on Friday, October 26, 2012
I agree with Sammy. I am having no luck at all.
RyanH
2:15 pm on Friday, October 26, 2012
Gave up after 10 minutes on hold. It looks like the URL in this article will only work *after* it's been verified that you might be affected.
Scary stuff. What worries me is not so much the credit/debit card information, but that tax returns quite often have bank account information (routing and account numbers) on them for direct deposits. That information plus a SSN can get a hacker through a lot of doors.
Jamie Healy
2:22 pm on Friday, October 26, 2012
It does - I've been on hold for a 1/2 hour waiting for a customer care rep
Patrick Goodwin
2:25 pm on Friday, October 26, 2012
as i stated earlier here ...i got through and they don't have anymore info than what we already know.The site I think is a waste of time . I got through and was told anyone effected will be notified by mail from the State .So I wouldn't even bother calling the number and tring the site...there are a ton of us looking for info...I would say catch the news at 5 on channel 7 ,wspa...they are the earliest .
Ann
6:39 pm on Friday, October 26, 2012
What will happen if you moved out of state?
Shawn Drury
8:14 pm on Friday, October 26, 2012
Ann, Even if you filed one tax return in SC since 1998 you should check your status.
5 War Veteran
2:56 pm on Friday, October 26, 2012
And we are supposed to trust the government?
JoSCh
3:06 pm on Friday, October 26, 2012
http://www.youtube.com/watch?v=O3ZOKDmorj0
Stephanie
3:12 pm on Friday, October 26, 2012
There's no news whatsoever on the Governor's homepage. Just lots of self promotion. For those of us wanting to know why personal information we're required by law to provide was not protected--well, it's NOT a great day in South Carolina.
JoSCh
3:20 pm on Friday, October 26, 2012
There is on the DOR website.
http://www.sctax.org/default.htm
Holding the governor accountable for this is the same as morons who hold the president accountable for individual embassies; well below their paygrade.
Calvin Fortune
3:13 pm on Friday, October 26, 2012
make the code available without having to call first
Calvin Fortune
Shawn Drury
8:14 pm on Friday, October 26, 2012
Calvin, I'm told that everyone's code is different.
Patrick Goodwin
3:27 pm on Friday, October 26, 2012
I do beleive she was voted in by the people of this state...she oversee's all these dept.'s....so ya ...she is accountable .We will see what she has to say before a judgement can be made.
JoSCh
3:32 pm on Friday, October 26, 2012
Trash didn't get taken out in some interns cube, IMPEACH THE GOVERNOR!
Tom Utley
3:28 pm on Friday, October 26, 2012
Good ol' government, always finding a way to screw up
JoSCh
3:31 pm on Friday, October 26, 2012
So bitter.
steve henderson
3:59 pm on Friday, October 26, 2012
So true unfortunatly
Tom Utley
4:00 pm on Friday, October 26, 2012
Not bitter, I just like to point out reality.
steve henderson
3:51 pm on Friday, October 26, 2012
Typical state government. Could any if these people survive in the real world?
Cold War Vet
4:13 pm on Friday, October 26, 2012
Our county has been under cyber attacks for a long time. Every government agency needs to do whatever is necessary to strengthen firewalls and protection systems to defeat hackers.
Ed Eichelberger
4:28 pm on Friday, October 26, 2012
More reason to eliminate the state income tax! Gov't agencies have a fiduciary responsibility to protect this info from hackers. In the business world we fire IT contractors when this happens. Time and time again government agencies prove they cannot stay ahead of the hackers.
Tom Utley
4:46 pm on Friday, October 26, 2012
Imagine what would happen if you or I allowed 3.6 million identities to be stolen and then we didn't tell anybody for 16 days. Just imagine the hell that would rain down upon us from the government if we did that.
Monopolies are bad, especially the government monopoly.
June S Smith
4:33 pm on Friday, October 26, 2012
It is not her fault that we got Hacked but it is her fault that we were not notified earlier.And we are just as guilty because WE put our info in the system . It can happen anytime & anywhere.
Did you know there is a chip in EVERY copy machine that keeps records.How save is that? the gravyaed for copy machines haven't had the chips taken out. What about the PC you had in the past ? Did you remove all your info or just thought you did ? So be real guys your info is out there somewhere if you have used any wifi device
JSS.
Stephanie
5:07 pm on Friday, October 26, 2012
All I would want, after the fact, is to be assured IMMEDIATELY that the state apologizes and all the stops would be pulled out to make sure my id is safe and uncompromised. That's good leadership. Not a web address and a phone number for a private pay site that is useless.
Diana Grove
5:58 pm on Friday, October 26, 2012
I want a Hotline set up at the Govenor's office startig now, and manned 24/7 with operators calling everyone whose information may have been compromised. Also, South Carolina residents need a number to call directly to a SC Govenment office to obtain information about possible compromise of personal information. In other words, start the notification now !!! I just tried to call the number given and a recording advised there was high call volume and to call back late. People of South Caroilna want action now.
Alice Rigney
6:28 pm on Friday, October 26, 2012
This is unbelievable. If they can fix the problem "after" - why weren't the right systems in place "before" my social security number, bank accounts and income inforrmation was stolen. Aren't these people required to have a Disaster Recovery Plan? And now, I'm suppose to sit back and wait for someone to hack into my accounts, while they waste another week figuring out how to notify me. The article stated they became aware October 10th - that was 16 days ago - and they still don't have everything in place to deal with the taxpayers. Yes, I'm very upset.
Mike N.
6:35 pm on Friday, October 26, 2012
>The article stated they became aware October 10th - that was 16 days ago
I think my credit card company knew last weekend. I made a purchase over the Internet and they temporarily shut down my card for suspected fraud - but all transactions were mine and there were no fraudulent purchases.
Mike N.
6:31 pm on Friday, October 26, 2012
"The state will provide those affected with one year of credit monitoring and identify-theft protection free of charge. The cost for this was not provided."
Credit monitoring is nearly useless, and only catches fraud after the bad guy gets away. Freeze your credit and solve the problem permanently. http://www.clarkhoward.com/news/clark-howard/personal-finance-credit/credit-freeze-and-thaw-guide/nFbL/
[ And I wonder if a credit freeze should be free since all taxpayers in the state are victims of identity fraud. But it's still worth the $10 X 3 for peace of mind ]
I'm going to save the state taxpayers money by turning down the credit monitoring service since I'm already frozen.
Karen Lord
7:06 pm on Friday, October 26, 2012
ObamaCare requires that all our medical records are electronic also, I wonder what will happen when those are hacked! There needs to be really good firewalls on our info held by others.
SCbeachlover
8:06 pm on Friday, October 26, 2012
Thanks Gov. Nikki "Tea Party" Haley. Probably thought it was too expensive to have a decent IT Officer and Department. Voters please remember this major screw up for the next Gubernatorial election. She's fired!!!
Trisha Stevens
9:34 pm on Friday, October 26, 2012
She's so fired!!
Melinda smith
9:51 am on Saturday, October 27, 2012
I also called 73 times then 55 minutes on hold got 2 codes for us and now I don't know if bank acct numbers or children's social numbers were taken. I think they need to give more info here and pay for more than 1 credit protection there are 3 credit bereus and it cost money to get new bank accts and debit cards. Really
Denise Lane Painter
9:57 am on Saturday, October 27, 2012
"Earlier in the day, WLTX reported the security breach but Haley said that report had nothing to do with timing of announcement, which came more than two weeks after officials realized a breach had occurred." Horsepoo. We should have been told about this as soon as it happened, but they were sitting on it while trying to figure out a way to make it go away. How much you want to bet that if WLTX (good job guys!) hadn't dug up this story, we still wouldn't know? The fact that the toll free number they gave us keeps crashing is enough - they obviously weren't prepared. Prepared AT ALL, I might add....there should have been a disaster plan for just such occurrence, but Ms. Haley and the state seems to have been caught with their underwear around their ankles on this one. And they can't claim ignorance - hell, Anonymous has tee shirts now, for goodness sakes! This is just another level of incompetence and arrogance by the Republicans who have had an iron grip on this state for years. We are last in almost everything, while she jets off to France, London and India. Our homeless rate is rising while she's redecorating the Governor's mansion. And while she was out on the campaign trail with Mitt, our stuff got stolen. Governor Haley is doing pretty good. Can't say the same for me.
Roy L. Lambert
10:00 am on Saturday, October 27, 2012
I don't see anywhere to use any activation code//////
Patrick Goodwin
11:20 am on Saturday, October 27, 2012
if they got our social security ,and banking ifo etc ...i filed via internet on my taxes .do they have my email info and is that at risk as well. ? Is my pc at risk,what about emplloyer's who do direct deposit's ? I seem to be thinking to much ? There is so much info that is givin to the state when filing taxes ...how much did they really get ? How about our investment information ..our retirement benefits . This is a HUGE deal Govener Harly.We need to know every aspect of the breach. Is everything we have givin to the DOR been breached or was it just the info on SS and banking ...LOTS of unansered questions . What do our Presidential canadates have to say ? What would Gov. Romney do where he was a governor? He was supported by Haly .
Deb
11:38 am on Saturday, October 27, 2012
Things keep changing. I called the 866-578-5422 number that is published everywhere. An acitvation number is provided in Nato phonetic alphabet to prevent mispellings (ie. F as in Foxtrot) and you are directed to go to the www.protectmyid.com/scdor website.
Earlier I could get to the Experian webpage where you could enter the activation code... but whether it was entered with the letters all caps or otherwise, the activation code is invalid.
Now... if you type in www.protectmyid.com/scdor, you cannot even get to that page. Instead you are sent directly to the signup page to enroll in a paid servie.
Does anyone know what is going on?
No name
9:50 am on Sunday, November 18, 2012
I also tried the website and got an invalid code response. So I called 18669606943 and they informed me that some web browsers (safari, firefox) do not work correctly with their website. Instead of letting you go to the /SCDOR page, those browsers redirect you to the main page.
I was able to enroll over the phone.
Charlena Armstrong
11:42 am on Saturday, October 27, 2012
I, too, called the number and received a recording about the activation code. Where should I enter it? This is really crazy. I also have a credit freeze ..what happens now?
J
12:16 pm on Saturday, October 27, 2012
just go to protectmyid.com/scdor and put in code scdor123
Deb
12:48 pm on Saturday, October 27, 2012
It's finally working... for now. Hurry or it may stop again!
J
12:18 pm on Saturday, October 27, 2012
From what I gather it sounds like there web and phone services are getting overloaded. It seems once there was a maximum number of people on hold the auto phone recording would just simply say call back later. As for the webpage it seems to be throttling to a default page if it can't process requests fast enough.
Jamie Healy
2:04 pm on Saturday, October 27, 2012
Everyone -
Go to http://www.protectmyid.com/default.aspx?sc=676980
Type in Activation Code scdor123
Fill in your personal info and proceed
That's it. No need to call the number listed.
Jerry Stevens
3:38 pm on Saturday, October 27, 2012
I planned to post that very information but I see you have already done so.
There are tens and maybe hundreds of thousands of people calling. There is no way they could answer them all and there most certainly not a list of people whose information was compromised.
The message says "if you believe your information has been compromised" you are eligible for free i.d. protection. Well, I decided I believe mine has because the thieves allegedly got them all. They give the same security code for everyone that calls. The message goes on to say that if you use the code and are not a resident of SC, your account will be cancelled or you will be asked to pay. So yes, go to www.protectmyid.com/scdor and enter the code SCDOR123. (Nice security right there, huh?) From there, you enter your information and get immediate access to see if there are any red flags on your credit.
Loretta Scott
1:01 am on Tuesday, October 30, 2012
Can you tell me what field to type in the Activation code? When i click on your link you provided, I see in the right hand corner a gray box that says "Backed by our 14 day Money Back Guarantee". I fill in my first and last name and zip and then click on the yellow "Protech Your Identity NOW!" button. Once I complete the next screen and hit Submit & Continue, it brings me to another set of questions and the only field I see there is the Promotional Code. Is this where I enter the "scdor123", because there is no other place to enter it. Please reply with how you were able to enter that code.
Angela Higbee
9:09 am on Tuesday, October 30, 2012
Thanks Jamie, it worked right away
Patrick Goodwin
2:33 pm on Saturday, October 27, 2012
just did it the address above that Jamie posted.Thanks Jamie !
Loretta Scott
1:03 am on Tuesday, October 30, 2012
Where did you see the field to add the Activation code, all i could find was the Promotional code?
Torie Little
4:06 pm on Saturday, October 27, 2012
What if using SCDOR123 is a phishing scam?
Patrick Goodwin
5:00 pm on Saturday, October 27, 2012
Then the state would have another problem ....
Jamie Healy
6:45 pm on Saturday, October 27, 2012
Phishing for what??? You're information has already been compromised/exposed. What more could they possibly get?
J
7:05 pm on Saturday, October 27, 2012
I believe the scdor123 was a generic account for certain people to gain access quickly which was leaked to the public whereas the rest of the peons I mean citizens have to wait until they can call in and get a verifiable access code. I have mixed feeling using the generic code because it means more money being paid by us taxpayers in South Caroilna for each person who uses it. As for the comment about "the state" we are the state. We will be the ones with the problem footing the bill and paying for security. Haley only has a few years left and whoever you like Dem/Pub your ID will likely be compromised in years after they're gone not in the one year trial.
J
7:10 pm on Saturday, October 27, 2012
Oh and if scdor123 is a phisihing scam it's coming internally from myprotectid.com which would be more laughable that the site to protect the fraud cases was hacked. The hackers would have to internally inject code inside the myprotectid.com site.
Karen
12:54 am on Sunday, October 28, 2012
This is inexcusable for a state gov't agency to not only be so lax in security in the first place, but be so low-tech in having help for the victims in place. The helpline closes at 8PM on weekends-, I just found out about this at 11 PM. Are the hackers closed at 8PM also? I'm not putting more of my info on a generic site. Gov't workers should be working overtime 24 hrs until this is fixed.
Jamie Healy
8:34 am on Sunday, October 28, 2012
That 24 hr overtime then comes right out of your pocket as a taxpayer.
I'm not saying that everyone doesn't have a right to be upset because they do. But I do want to mention that every time you buy something online, every time you throw away a credit card receipt, every time you buy gas at a pump with your credit card or stand in line at the grocery store or give your doctor you personal info for their records, or pretty much do just about anything in your normal daily activities that requires spending money or giving personal info, you are open to exposure & fraud. It's open season on fraud 24 hrs a day, 7 days a week in this day & age. Our personal info is already out there from one place or another. It's kind of like winning the lottery w/ a really bad outcome as to whether or not they'll use yours. In addition to breaches like this, there are everyday occurrences. We should all be doing our own part, as should the banks & credit cards companies that we hand our money to, to hold accounts w/. Those who handle our funds should be held more accountable, in addition to those who handle our personal data. But to demand things from the state or governor that are completely ridiculous aren't getting us anywhere. There should be tighter restrictions - start a petition or something that will affect the cc companies & banks so they are forced to provide us w/ fraud protection. When buying something, whether online or in person, when's the last time you showed ID?
Anonymous
12:02 pm on Sunday, October 28, 2012
This protectmyid.com sit is Experian. An international marketing company as well. This is the Wikipedia read on protectmyid.com; the company we are advised to use: In August 2005 Experian accepted a settlement with the Federal Trade Commission (FTC) over charges that Experian had violated a previous settlement with the FTC. The FTC's allegations concerned customers who signed up for the "free credit report" at Experian's Consumerinfo.com site. The FTC alleged that ads for the "free credit report" did not adequately disclose that Experian would automatically enroll customers in Experian's $79.95 credit-monitoring program.[7][8]
Regina Edge
11:08 pm on Monday, October 29, 2012
where do you type in the activation code. I do not see a spot. says enter first and lasst name and then zip. I have tried to do it. will not let me. I do not see spot to enter activation code before I enter my name and zip Help!!!!!
Tiffany Barkley
10:30 am on Tuesday, October 30, 2012
Regina,
Go to this website: http://www.protectmyid.com/default.aspx?sc=676980 and there should be a box to enter the code into first. Let me know if that works.
-Tiffany
Karen
9:10 am on Tuesday, October 30, 2012
Actually, I called our tax accountant, and he gave us the same info. So the website is legit. When you go to the site, register as if you were a new customer wanting to sign up, then put in the code when asked too. I did it, but the site is so busy, it couldn't process my request, but keep on trying, y'all. I really think that since the SC Dept of Revenue was so lax by not encrypting our SS numbers, they themselves should have done this whole thing for us and turned all of our numbers in to Experian so we wouldn't have to go through this hassle ourselves.
victoria morrison
6:46 pm on Tuesday, November 6, 2012
go to protectmyid.com/scdor put in code scdor123 i got it out of newspaper...signed up for free...still don't know if i am one of the "hacked"? sincerely vickie
BEA BEAMER
2:02 pm on Wednesday, November 21, 2012
I TRIED THIS AND THERE IS NO PLACE TO INPUT THIS CODE
JoSCh
2:10 pm on Wednesday, November 21, 2012
IF/WHEN YOU DO FIND IT TURN OFF YOUR CAPS LOCK BEA!!!
Passwords are case sensitive. And typing in all caps means you're shouting.