SC hacking victims asked to pay for monitoring that is free next year

ashain@thestate.comSeptember 16, 2013 

Update:

The Experian call center is telling S.C. hacking victims that the state will not offer free credit-report monitoring next year -- and instead should pay to have their financial records protected after last year's massive data breach at the state Department of Revenue.

"It's not going to be free anymore," an Experian representative said Tuesday in response to call from a hacking victim. "Because we were offering it at such a discount, we were told South Carolina is not going to do it at all."

The state will continue to offer free monitoring and will award a new one-year contract Monday. The state could offer monitoring for at least five years.

The S.C. Department of Revenue said it was not aware that Experian was sending renewal requests until hacking victims started receiving them.

The state agency posted a notice on its website at 5 p.m. Tuesday suggesting hacking victims should wait to make a decision about which monitoring service to use.

Experian -- which received a $12 million, no-bid one-year contract after the breach was found last year -- has declined to bid for the new year-long, $10 million agreement that starts Oct. 24.

The deadline for submitting bids for the new monitoring contract was Sept. 9. Experian started sending renewal notices to the 1.5 million people who enrolled for free monitoring four days later.

South Carolinians seeking clarification from the state are sent to Experian. Calls to the S.C. Department of Revenue about identity security questions were being transferred to the company's call center on Tuesday.

An Experian representative who answered Tuesday morning said the state was no longer offering free credit monitoring after not renewing the agreement with her company.

The representative said the state was not going to sign a monitoring agreement with any company since Experian was offering its service for $11.88 a year -- a deep discount from the retail price of $160.

Experian said the call-center agent's response "does not reflect the approved information conveyed to all of our representatives. ... We have moved quickly to correct this."

Asked why the agency was not prepared, the revenue department said, "When the initial credit protection contract was signed, we did not anticipate the General Assembly providing another free year of credit protection."

Lawmakers frequently discussed funding additional years of credit monitoring after the legislative session convened in January, and the state Budget and Control Board, headed by Gov. Nikki Haley, agreed in May to offer five years of monitoring.

The revenue department said it transferred taxpayers to Experian's call center as a convenience, but added, "We will soon update the option to reflect the new credit protection plan."

Hackers stole personal information belonging to 6.4 million consumers and businesses last year in the nation's worst breach at a state agency.

Original story:

The firm given a $12 million, no-bid contract to offer credit-report monitoring after a massive data breach last year won’t seek a new $10 million deal with the state.

“The marketing, service and product delivery requirements of the state were extensive compared to current limitations of the state appropriated budget,” Experian said in a statement Monday.

Instead, Experian is trying to get the nearly 1.5 million hacking victims who enrolled for credit monitoring through it to renew before the state chooses another company that will offer the service at no cost to consumers.

Experian has started sending emails offering a year of credit monitoring for $11.88 to individuals who were victims of the S.C. Department of Revenue breach. The service normally carries a retail cost of $160. Coverage for a family will be offered at Experian’s full retail price, which is $240.

If 5 percent of S.C. hacking victims renew, as an Experian executive has estimated, the company would earn nearly $900,000 next year. The firm did not say what it would charge in subsequent years.

Sara Nalley, a retired Columbia College professor, said she called the Revenue Department on Monday after getting the Experian email. She said she was referred to Experian, which did not tell her that another company might offer the service at no cost.

“The Department of Revenue should tell us what is going on – not Experian,” Nalley said. “They should not drop the ball. This whole thing is just an unfortunate situation because my Social Security number is out there forever. The state has to take responsibility for that.”

The Revenue Department did not respond to questions submitted to it Monday morning by The State.

Experian won a $12 million, one-year emergency contract 11 months ago, after state officials learned hackers had stolen tax information belonging to 6.4 million consumers and businesses from the Revenue Department. The breach is the nation’s largest at a state agency.

The contract did not limit how Experian could use the information that it collected from hacking victims who enrolled. The company’s privacy notice said it can share information with other firms.

Experian gave Gov. Nikki Haley’s office a proposal offering a second year of monitoring for $10 million in December. But the state chose to open bidding for the second year after several lawmakers complained that Experian had received the first agreement without competition.

South Carolina will select a new firm to offer credit monitoring as early as next week, according to the State Budget and Control Board. The new contractor must start offering monitoring by Oct. 24.

House Majority Leader Bruce Bannister, R-Greenville, said he was disappointed Experian would not bid on the new contract. “People would have liked some continuity.”

Bannister called Experian’s efforts to renew consumers “reasonable for a for-profit business to do. ... They got the advantage by being first to the table on the state nickel.”

Bannister expects Experian to offer smaller discounts on monitoring in future years. He said hacking victims will have to weigh the best service for themselves. “The state is not going to provide private protection indefinitely.”

The State is pleased to provide this opportunity to share information, experiences and observations about what's in the news. Some of the comments may be reprinted elsewhere in the site or in the newspaper. We encourage lively, open debate on the issues of the day, and ask that you refrain from profanity, hate speech, personal comments and remarks that are off point. Thank you for taking the time to offer your thoughts.

Commenting FAQs | Terms of Service