The South Carolina Department of Revenue said that approximately 3.6 million Social Security numbers and 387,000 credit and debit card numbers have been hacked in cyber attack.
"On October 10, the S.C. Division of Information Technology informed the S.C. Department of Revenue of a potential cyber attack involving the personal information of taxpayers," said DOR Director James Etter. "We worked with them throughout that day to determine what may have happened and what steps to take to address the situation. We also immediately began consultations with state and federal law enforcement agencies and briefed the governor's office."
Anyone who has filed a South Carolina tax return since 1998 is urged to contact Experian by calling 1-866-578-5422. The call center is open 9:00 AM - 9:00 PM EST on Monday through Friday and 11:00 AM - 8:00 PM EST on Saturday and Sunday. They will give you a promotional code to enter at protectmyid.com/scdor. That promotional code is good for one free year of service.
Each promotional code only works for one account.
NewsChannel 15 is getting conflicting reports about who will receive the identity theft protection using Experian software for free.
The state says it will provide one year of credit monitoring and identity theft protection to taxpayers who are affected.
At this point, Experian does not have knowledge of whose information has been compromised. The information will be given to them within the next few days from the state, according to an Experian customer service agent.
Experian's service cost is $15.95 a month. NewsChannel 15 is waiting to hear from the Department of Revenue how much money the agency is paying for the service.
Approximately 70 people work in Experian's call center, and some customers have been put on hold for as long as two hours, according to the customer service agent.
Experian also has a mobile app for iPhone, Androids and other smartphones, as well as, iPad tablets.
The 2011 U.S. Census shows 4.6 million people live in South Carolina. So more than 78 percent of residents could be affected.
If your credit card information is compromised, SCDOR wants taxpayers to have your bank reissue a card.
Anyone who has used a credit card in a transaction with the Department of Revenue should check bank accounts regularly to see if any unauthorized charges have occurred.
If so, the cardholder should contact the credit card issuer immediately by calling the toll-free number located on the back of the card or on a monthly statement, tell them what you have seen, and ask them to cancel and reissue the card. Consumers should also change any credit card web account passwords immediately when unauthorized charges are detected.
On October 16, investigators uncovered two attempts to probe the system in early September, and later learned that a previous attempt was made in late August.
In mid-September, two other intrusions occurred, and to the best of the department's knowledge, the hacker obtained data for the first time. No other intrusions have been uncovered at this time. On October 20, the vulnerability in the system was closed and, to the best of the department's knowledge, secured.
"The number of records breached requires an unprecedented, large-scale response by the Department of Revenue, the State of South Carolina and all our citizens," said Governor Nikki Haley. "We are taking immediate steps to protect the taxpayers of South Carolina, including providing one year of credit monitoring and identity protection to those affected."
"From the first moment we learned of this, our top priority has been to protect the taxpayers and the citizens of South Carolina, and every action we've taken has been consistent with that priority," Etter said. "We have an obligation to protect the personal information entrusted to us, and we are redoubling our efforts to meet that obligation."
Of the credit cards, the vast majority are protected by strong encryption deemed sufficient under the demanding credit card industry standards to protect the data and cardholders and approximately 16,000 are unencrypted, according to the SCDOR.
Officials said that no public funds were accessed or put at risk.
In addition to the Experian service, state officials urged individuals to consider additional steps to protect their identity and financial information, including:
Regularly review credit reports;
Place fraud alerts with the three credit bureaus;
Place a security freeze on financial and credit information with the three credit bureaus.