Protect Yourself from ID Theft After SC Security Breach
What should the 3.6 million South Carolinians whose personal information was stolen by hackers do to protect themselves now?
More than 3 million South Carolina residents are asking, "Now what?"
They're getting a crash course in dealing with identity theft following Friday's revelation that a foreign hacker stole 3.6 million Social Security numbers and 387,000 credit card numbers from a S.C. Department of Revenue database.
State officials say the database that was hacked contained personal information belonging to taxpayers stretching back 14 years.
So now that just about everyone who has filed a S.C. tax return since 1998 is a potential victim of identity theft, how should they go about trying to protect themselves?
First, you need to call the phone number the state has set up (1-866-578-5422) to find out if your information was stolen. If so, you'll get to sign up for the year of credit monitoring and identity theft protection Gov. Nikki Haley said the state would provide for anyone affected.
Residents can choose to receive alerts via the U.S. Postal Service or through an online system. Those who select the online option will receive an activation code for the online system.
Many who tried to call Friday afternoon heard a recorded message telling them to call back later because of high call volume, but Haley spokesman Rob Godfrey said via email late Friday that, "we have increased and are continuing to increase the number of people assisting South Carolinians who call the call center."
The phone line will run 9 a.m. - 9 p.m. Monday - Friday, and 11 a.m. - 8 p.m. Saturday and Sunday.
The Federal Trade Commission also suggested that people closely monitor their bank and credit card statements, and regularly check their credit report through all three major credit bureaus, in addition to several other steps to detect identity theft.
For people who suspect their information has been stolen, the FTC also suggests placing a fraud alert on their credit report. Finally, people also may file a complaint with the FTC.
People can perform a number of the tasks that identity-theft protection services offer, though it can be time consuming. For some people, saving that time is worth the monthly cost of such a service. While the state will provide a year of Experian's ProtectMyID service, there are many companies that offer similar services. TopTenReviews.com ranked 11 of them on a multitude of categories (two of which scored higher than ProtectMyID).
However, no identity protection service is perfect, nor can they protect against every possible threat. The FTC cautioned consumers to research identity theft protection services before signing up for one, and to make sure they know exactly what they are paying for.
For the DIY Crowd
As PCWorld writer Nick Mediati notes, most identity theft protection services don't offer anything people can't do on their own for free or little cost. The services are mostly offering convenience.
For those that want to do their own identity protection, several resources are available.
The FTC notes that consumers are entitled to two kinds of fraud alerts; an initial alert, and an extended alert.
Consumers can request an initial fraud alert on their credit report if they suspect their personal information has been compromised, for example if a hacker stole their Social Security number and credit card information from a state database. Initial fraud alerts last 90 days, but can be renewed. Placing an initial fraud alert on a credit report entitles the consumer to request a free copy of his or her credit report from each of the credit reporting agencies (Equifax, Experian and TransUnion).
Consumers only need to contact one of the agencies to request a fraud alert, because each is required by law to inform the others.
Consumers who have already been victims of identity theft can request an extended fraud alert that lasts seven years. Consumers who request an extended fraud alert on their report are entitled to two free credit reports from each of the agencies within a single 12-month period.
Consumers can also place a security freeze on their credit report that will restrict companies from accessing a person's credit report without his or her express permission.
To place a security freeze on your credit report you will need to contact each of the reporting agencies and provide the following information:
- Full name (including middle initial, Jr., Sr., II, III, etc.)
- Social Security number
- Date of birth
- Address (include all previous addresses in the preceding two to five years, depending on the specific credit-reporting agency requirements)
- Proof of current address (utility or phone bill will suffice)
- Photocopy of government issued identification (driver's license or state ID card)
Finally, everyone is entitled to one free copy of his/her credit report from each of the three reporting agencies each year, which can be requested via www.annualcreditreport.com.
Frank Lambert
8:35 am on Saturday, October 27, 2012
I find it totally inexcusable and reckless for the so-called governor of South Carolina to delay notifying citizens of the liabilities created over two weeks ago.
Mark Stevens
8:57 am on Saturday, October 27, 2012
I'd like to know who the moron was who thought it not necessary to encrypt its own residents SS#'s. The State is liable for any and all problems that arrise fom this info being used
Tom Utley
9:24 am on Tuesday, October 30, 2012
As a computer engineer I can tell you with 100% confidence that there is no reason, and I mean absolutely no reason, that the data shouldn't have been encrypted. This is an absolute and total failure of the government to adequately handle personal information, but what should we expect? That's what government does: fail.
In any system like this, you have three parts: The data, the application, and the presentation. The presentation could be a web page or a computer terminal. The application is the software that processes the data. It adds new stuff, deletes stuff, creates reports, etc. The data is usually stored in a database and this is what got hacked into.
Now, on day 1 of any software developer's career in the voluntary sector (working for a company as opposed to the government) they are told that any time they store sensitive information, the application must encrypt the data before putting it into the database. So all that you see in the database for sensitive fields is just gobbledy-gook. (A long string of numbers, symbols, and letters that doesn't look like anything recognizeable).
Then the application contains the decryption method, which is only known to the application. This can be done many ways, but the principle is the same.
Long story short, the data should have been encrypted, no excuses.
Patrick Goodwin
9:26 am on Saturday, October 27, 2012
'terrorist attack'.That is exactly what is is.We must give our social security and banking information to the state by law. How are they different from any company that we do business with that we give that information to.I have already had issues with my credit and debt cards in the last week,I have had a bill already tell me that my debt card was breached ,and when they processed it for my monthly payment ,it came back as stolen.I never reported it stolen.Now thing's are making sense.Now I wonder how many of my direct depposit's and direct withdraw's for monthly bills have been compromised .I have already had to change our debt cards because of this 2 weeks ago due to the suspision that something happen .Now I know why. Why we were not notified alot earlier than 16 day's ?Now I have to call every creditor,and bank institution,monthly bills etc and change all of my info? Our State goverment has let us down big time . They are not any different than any other company or institution that is givin our private info to do business.They are liable .Period.Now the burden is going to be passed down to all business in the state ,and employer's .Employer's do direct deposit's and now that information is now as well compromised.Any business who has paid taxes to the state out of state ...they to will be hacked .Where doe's this end ? Governor Haley,you messed up bacd and probably cost yourself a job.Any good lawyer's out there ?Time to go paperless again,medical records are next
Justin Rusher
10:12 am on Saturday, October 27, 2012
Typical Nikki Haley administration. Vote the Republican bigots out!
Denise Lane Painter
10:17 am on Saturday, October 27, 2012
But our Governor said that all you have to do is call the magic number and the ID Security fairy will make sure everything is ok. More taxpayer dollars down the drain...they say we can all have a year of ID Theft monitoring for a year, but it's not free...we all have to pay for it. Wait, isn't being forced by our government to pay tax dollars for a program we didn't ask for and don't want SOCIALISM? Maybe if Ms. Haley had been at home doing her job for the last year instead of out walking a beat for other Teabagger candidates this wouldn't have happened. Or maybe if her predecessor had been doing his job instead of down in South America having a party, this wouldn't have happened. Who knows? But it seems to me that while they're having all the fun, we're getting screwed.
George Tempel
10:31 am on Saturday, October 27, 2012
Trikki Nikki has done it to South Carolina again. The executive branch went into full protective mode, waiting over two weeks to let the public know of their incompetence.
Justice Prudence
12:25 pm on Saturday, October 27, 2012
SS#'s are NOT a form of identification! This used to be printed on SS CARDS as well as to NOT laminate those cards. My point? NONE of us should have EVER been made to "show" or use our SS#'s as a form of ID!!!
And for 2 weeks that woman who makes only a portion of her staff and certain employees of the State say "...it's a beautiful day in SC..." Can SUCK IT HARD. She is the WORST thing that has ever happened to this state besides that Tim Scott! IMPEACH that woman and give the Job to Glenn McConnell. He at least won't FECK things up like that woman has for the residents of this State!
margaret
6:13 pm on Saturday, October 27, 2012
I'm sorry but I have had to use my ss number as an I.D. I don't get treated as well as an illegal. THIS IS A SORRY TIME IN HISTORY NO PROTECTION FOR AMERICAN CITIZENS
stanley seigler
7:11 pm on Saturday, October 27, 2012
re: 'I have had to use my ss number as an I.D... I don't get treated as well as an illegal.' [margaret]
goes to show us (me anyway) we dont begin to know the plight of our neighbors...i had never considered it (SS#) as a form of ID...that said;
opine:
doubt any are not treated better than illegals...also doubt if most know the plight of illegals in our country...
for the most part they are hard working good people who are trying to provide a better life, doing work most of us will not do, for their families...and
the agriculture and service sectors would suffer substantial losses if not for illegals...eg/ie, produce would rot in the fields...prices for strawberries (eg) would double...
apologies for not related to 'ID theft' comments...but someone else broached the topic...
PS. not an illegal or an employer of illegals.
NanaSal
8:36 pm on Saturday, October 27, 2012
Called the phone number and was given the code to go online. Would you believe it doesn't work!!! At least I can't get it to work. What the heck is going on!!! AND all the offices aren't open now. I'm really MAD!!!!!!!!!!!!!!!!!!!!!!!
steve henderson
2:12 pm on Sunday, October 28, 2012
You are correct. It does not work. What a group of idiots.
sandpiper0
10:31 pm on Saturday, October 27, 2012
I know you should not carry your social security card with you all the time. But, I am on Medicare. My Medicare card number is my social security number.. I have to show my medicare card every time I see a doctor, therefore I must carry it with me. And it is extremely irritating to have the doctor's office worker yell out "what is your social security number" in front of everyone in the waiting room. Now, I have to worry about identity theft because our State Government can't keep our information safe.
Years ago, I lived in Georgia and your social security number and your drivers license number were the same. Times have changed! .
Karen
11:45 pm on Saturday, October 27, 2012
I am afraid to even call to see if our SocSec & credit cards have been breached. It's inexcusable for the SC Dep't of Revenue to have such lax security, AND to not have people on the helpline after 8pm on weekends. This is a SERIOUS breach- 3 million affected- there are only 4 million in the state!
John R
1:21 am on Sunday, October 28, 2012
This is an outrage! Maybe now this young governor will stay in Columbia and tend to the business of governing South Carolina instead of running around trying to get get national attention for herself. I knew she was too young and too inexperience to be a governor. She alienated people in the assembly long before she was elected governor so she operates in a very small circle in Columbia. She alienated the people in Washington by acting like a school girl when she went up there. If her background is accounting, one would think that data security would be her first priority when she took office. You can't take care of business at home if you're hanging out with Fox & Friends in New York. I hope people will remember this at the next election. We need someone with experience and who can serve as a diplomat and get along with the lawmakers in Washington and Columbia. Chalk this disaster up to an inexperience rookie trying to make a name for herself.
steve henderson
1:49 pm on Sunday, October 28, 2012
Web site still does not work Enter SCDOR123 at the web site and nothing happens. Why did I expect anything different. Why to go Nikki
Jerry Stevens
3:11 pm on Sunday, October 28, 2012
I wonder why it didn't work for you. It worked for me, for my wife and it worked for my friends.
steve henderson
2:10 pm on Sunday, October 28, 2012
Has the Governor told us how much this FREE protection will cost the state. It will only be freee if the Governor pays Experian out of her own pocket!! I don't think that will happen. We the taxpayers will foot the bill.
Robert Kelly
3:50 pm on Sunday, October 28, 2012
Tangent...To get a SC driver's license (when you move here from another state...maybe even locals) must show your SS card. Show proof of citizenship, (passport or birth certificate). Show proof of residency. You know what, if you printed your utility bill (insurance coverage, bank statement, etc.) online, which you could print on your home printer...it is not acceptable (who knew?). When we moved back here recently (after several years out of state residency), we still had to make 3 trips to the DMV, because they only told us one thing at a time. First trip: we need to get our SS cards. 2nd trip: we need proof of residency. 3rd trip: printed from your home computer; not acceptable. I got my license on the 4th trip. By the way, my Lexington County voter registration was not acceptable to prove residency for my driver's license. This tells me a lot about what the new voter picture ID law will do to people, especially those born out of state, or who can't prove residency because your banking is done online. With the utilities only in my name, not jointly, my wife has NO PROOF she lives here! Our insurance/banking is paperless (we thought for the efficiency and ecology). Her green card says she is in the country legally, but does not prove SC residency. Many voters are going to have these same problems, need multiple trips to resolve them. Some people don't have the time/ability for all those trips. Why do we need to show SS cards for a driver's license? So SC can lose it?
mary shelly
11:14 am on Monday, October 29, 2012
yes another coverup, federal, state , local its because we the people vote these idiots in office , i would like to thank the public education system for giving us such mindless mush ,who only think of lining their own pockets & passing laws that they don't follow
Taxation
12:50 pm on Monday, October 29, 2012
It could be 5 or 10 years before your information is passed around then finally targeted.
Regina Edge
11:26 pm on Monday, October 29, 2012
i have looked on this site. I do not see anywhere to enter an activation code option. says first name, last name and zip, then you go to the next page where you enter all personal information and after asked to enter ss# it ask for a promotional code and the scdor123 does not work in this spot. Finally, it ask for credit card. Is my system to old. I do see anywhere on this first page where I can enter a activation code. help!!!
Alex Saitta
7:32 am on Tuesday, October 30, 2012
The scope of this hacking job and the number of social security numbers stolen is mind boggling. Have more ever been stolen at one time? I suspect this is a record theft.
If this was a private company, the entire leadership of the computer security division would be fired for sleeping on the job. Yet, in the government, I would bet no one or group of employees is fired. Not one hauled in front of a legislative committee to explain what the heck happened, why and who was asleep.
Why aren't our leaders in the legislature calling for a investigation into who dropped the ball here? It is election time, and they don't want to make this a big deal in the press even though it is a huge deal.
Taxation is right, we are all going to need ID protection for 10 years or more. Maybe we need a tax credit on our income tax return for ID protection. I agree with Mark Stevens too. The state is probably liable here. I don't know if they can be sued, but if they can, likely they will be.
I agree. I was never impressed with Haley. She didn't do anything in the legislature to move the state in a conservative direction. She uses a lot of conservative buzz words, and is appealing to the national press because she is a woman and the daughter of immigrants. To me, she is more interested in trying to ride those things to national fame, then passing conservative legislation or being on top of her departments like the DOR to make sure they are doing their job.
Alex Saitta
7:51 am on Tuesday, October 30, 2012
I'm a conservative Republican, but right is right and wrong is wrong, and at times the finger needs to be pointed at someone who is being paid to do a job and be good at it.
This is one of those times. This is a huge security breach that will affect individuals like you and me for years and years. The Republicans like Haley need to call it what it is -- a huge breach, take responsibility for it (Republicans have run the government for years), and come forward with swift action to change computer security in the state government/ hire more capable people to run that department.
Haley isn't saying that or doing that. Her words were there is nothing we could have done about it. Baloney. Where is her plan to improve it or at least a speech saying this we are going to reform this department?
I'm glad the Democrats are asking the tough questions. (See link below) That's the only way we'll get some accountability and then improvement/ reform on this, so this doesn't happen again.
http://www.fitsnews.com/2012/10/29/democrats-demand-answers-from-nikki-haley-over-security-breach/
Mark Stevens
4:39 pm on Tuesday, October 30, 2012
Now it seems that all they keep saying is SS#s But in seeing more than just what is being reported from the Gov's office the files that were hacked contained the Tax returns for the 3.6 million residents.
Take a moment to think what was on your returns.
If you had any intrest bearing accounts,those bank #'s are in there.
Your Childrens SS#'s are in there.
Everything is in there!
An Identity thieves gold mine!
And it doesn't sound like there is enough concern for what happened (imho)
This is an outrage and a total lack of respect for us as SC citizens.
And as far as not being encrypted I agree with Tom Utley.
I'm no IT professional but it seems to me that someone dropped the ball!
Julia Sullivan
5:33 pm on Monday, November 5, 2012
Excellent article. This unfortunate episode shines a spotlight the huge disparity between cyber finances and cyber security. I've written a piece on the S.C. Breach, including some tips for consumers to stay safe in the aftermath. http://creditcardselect.com/hackers-outpacing-financial-security-at-alarming-rate/
FugitiveSquirrel
5:27 pm on Tuesday, February 5, 2013
So now, in FEBRUARY, we start getting confirmation that our information was among those hacked and stolen.
Shireese Bell
6:24 pm on Tuesday, February 5, 2013
I just got the email today, too.