South Carolina taxpayers and their children who were victims of a massive data breach at the Department of Revenue will receive free lifetime credit fraud resolution, Gov. Nikki Haley announced Tuesday.
Meanwhile, the Senate Finance Committee will hold the first legislative hearing since the breach became public four days ago. Revenue department director James Etter will answer questions at 2:30 p.m. Tuesday before the committee chaired by Sen. Hugh Leatherman, R-Florence.
[Click here for video of Tuesday's update from Gov. Haley • Also, scroll to the bottom of this story for information about what to do if you have filed taxes in SC since 1998.]
Haley said again Tuesday that she has no plans to discipline anyone in what is by far the state’s largest hacking incident in the past seven years. She said no one could have prevented the sophisticated breach and that blame belongs to the criminals who stole the data.
The state is paying for one-year of monitoring and up to $2 million in insurance from Experian after revealing Friday that foreign hackers stole 3.6 million Social Security numbers from people who paid state income taxes since 1998.
But the stolen data can be used years after the theft, technology security experts said. The information is often sold in batches among crooks who want to obtain bogus credit cards and loans under victims’ names or empty their bank accounts.
South Carolina and Experian agreed to offer free lifetime ID theft resolution to S.C. data breach victims, including help in eliminating bogus credit card accounts from credit histories. The company will help fix ID theft problems even if they are not related to the hacking at the revenue department.
Experian capped the state’s cost for providing the one year of monitoring and lifetime theft resolution at $12 million, Haley said. The governor said Monday that the one-year coverage might cost about $8 a person, or $28.8 million if everyone affected signs up.
About 287,000 people have registered for monitoring with Experian, she said. Wait times to sign up over the phone (866-578-5422) is about 10 minutes. Taxpayers also can register online at protectmyid.com/scdor and use the access code “scdor123.” The deadline is Jan. 31.
The state has spent $125,000 on Mandiant, a consultant recommended by the Secret Service to repair data technology gaps and install security measures. South Carolina also hired the Nelson Mullins law firm to assess liability issues, Haley said. No cost figures were available for the legal help.
SLED chief Mark Keel did not offer any updates on the criminal investigation on Tuesday.
The Secret Service, which is leading the investigation, told state officials about the breach at the S.C. Department of Revenue on Oct. 10. Hackers had accessed computers in August but did not take taxpayer information -- which also included nearly 400,000 credit-card numbers -- until September.
Much of the information including all the Social Security numbers were unencrypted.
What to do
From the Governor's Office: Anyone who has filed a South Carolina tax return since 1998 should take the following steps:
1. Call 1-866-578-5422 where you will enroll in a consumer protection service. The call center is open 9:00 AM – 9:00 PM EST on Monday through Friday and 11:00 AM – 8:00 PM EST on Saturday and Sunday.
2. Then you will determine if you wish to have an online or US Mail alert mechanism.
3. For the online service, visit http://www.protectmyid.com/scdor. For the US Mail service, you will receive notifications via the US mail.