SC Department of Revenue Reports Record Setting Data Breach

It was admitted publicly by state officials yesterday that the tax and banking information from millions of South Carolinians may have been compromised in a recent exploitation by hackers of the Department of Revenues servers.

What Happened: On October 10, the South Carolina Department of Revenue (DOR) was informed by the South Carolina Division of Information Technology (DSIT) of a potential cyber-attack involving the personal information of South Carolina Tax Payers. On October 12, the state hired an outside IT security firm, Mandiant, which on October 16, determined the intruders accessed state systems in early and mid-September. It wasn’t until eight days later, on October 20, that the suspected security hole was actually closed.

Who It Affects: In the aftermath of this discovery, it was determined that approximately 3.6 million Social Security numbers and 387,000 credit and debit card numbers of South Carolina Tax Payers may have been exposed (The entire population of the State of South Carolina is approximately 4.7 million), making this the largest breach of its kind in state history.

What’s Being Done: “We are taking immediate steps to protect the taxpayers of South Carolina, including providing one year of credit monitoring and identity protection to those affected,” Governor Nikki Haley said in a statement. In an effort to mitigate the potential damage, taxpayers in South Carolina who might have potentially been impacted are being provided one year of credit monitoring. Haley said the state was negotiating to offer protection at about $8 per person, which would cost the state about $29 million if every taxpayer affected registered.

South Carolina Taxpayers that have filed returns in that state since 1998 are encouraged to call the toll-free call center established by the DOR, 866-578-5422.

If you found this information helpful, you may want to consider taking part in the Identity Theft Resource Center’s Anyone3 fundraising campaign.  For more information or to donate please visit http://www.idtheftcenter.org/itrc-launches-anyone3-campaign.

There was a time when every parent knew what to tell their children to be safe. Children knew not to take candy from strangers, or go swimming right after eating. These days the rules have all changed and children have a new playground on which they must be trained in order to stay safe.

cyber securityThe cyberworld takes up a huge amount of children’s time and, unfortunately, is very dangerous. Sitting a child down and explaining to them about protecting their private information online or staying away from child predators is not easy. Here are some fun ways to teach your child cybersecurity.

  • Stay Safe Online: Stay Safe Online is a wonderful program put together by the National Cyber Security Alliance. Thier website (www.staysafeonline.org) provides a wealth of information for teachers and parents to use in order to teach children about cyber security. The site is even broken down into grade level so that children will not feel like something is too immature or way over their heads.
  • iKeepSafe: Within iKeepSafe’s website (www.ikeepsafe.org) there are areas for educators, communities and parents. There is also a section for children themselves to peruse and learn as they go. One of iKeepSafe’s programs is called “Prevent & Detect”. It teaches parents how they can use technology to prevent and detect everything from eating disorders to alcohol abuse. This is a great way for parents to learn how to use the cyberworld to help protect their children rather than simply fearing it.

Armed with these wonderful resources, it shouldn’t be such a hassle to help children understand the dangers of the Internet. Parents will be able to spend less time on explaining the intricacies of online identity theft and more time making sure their children look both ways before crossing the street.

“How to Teach Your Child About Cybersecurity” was written by Nikki Junker.  Nikki is the Social Media Manager at the Identity Theft Resource Center. We welcome you to post/reprint the above article, as written, giving credit to and linking back to the original post on the ITRC Blog.

Almost everybody has heard the horror stories and nightmare scenarios of an identity thief gaining your personal information and using it to establish credit card, loans and other lines of credit that you would not have applied for yourself. But what these scenarios rarely talk about are the steps you can take to prevent such an event from occurring, or what to do to clear your name should you find yourself in this situation.

Something that anybody can do, at any time, is to place a free 90-Day Fraud Alert on their credit reports. This requests that credit issuers (credit card companies, cell phones, etc) contact you first before they approve of any applications for credit. This will not affect accounts you have open or your credit score. As well, you can replace the fraud alert every 91 days at no charge, or extend it to seven years with a police report. The fraud alert can be applied for over the phone or going to each credit agency’s website directly. It’s always a good idea to place the fraud alert with all three companies yourself to make sure that possible fraud doesn’t get in the way of your protection.

Once you place the 90-Day Fraud Alert the credit reporting agencies will send to you a letter with instructions on how to gain a free copy of your credit report. This way you can make sure that everything is ok with your credit reports and fraud isn’t taking place. This report does not count towards your annual free credit report, allowing you to save that one for later.

But what should you do if there is something on your credit report? The first step is to file an Identity Theft Report through the Federal Trade Commission.

Once you have filed an Identity Theft Report, contact the companies that are reporting fraudulent accounts. Request to speak to their fraud or identity theft department and inform them of the fraudulent account. Fill out these documents, get them notarized, and send them back to the company/s with a copy of your Identity Theft Report. Some companies will ask for other things like a photocopy of your driver’s license. Make sure you send these documents with your packet. Make sure you send it Certified Mail Return Receipt so that you get proof of when they received your paperwork.

Continue to talk to these companies and, if need be, send them any documents they may request. If all goes well, they will recognize this was identity theft and they won’t hold you responsible. Make sure you get this in writing. Computers can error and humans make mistakes. These letters of clearance come in handy when this happens.

For more long term/permanent options for protection from identity theft (especially after you have already been victimized) look into freezing your credit reports with the three credit reporting agencies. The process is slightly different for each state, but all states offer the freeze for free to victims with a police report.

For more information, check out the ITRC victim assistance page here: http://www.idtheftcenter.org/knowledge-base.


If you think you may be a victim of identity theft, contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App.

I’m an old guy, and have been quite a few places, and done quite a few things. So, not much surprises me anymore. And, along with life’s lessons, I acquired over 25 years of business experience before retiring and ultimately ending up at the Identity Theft Resource Center (ITRC). But one thing that has continued to surprise me for the past 6 years is hearing the details of hundreds of new identity theft cases each and every month. I have found these cases to be constantly changing and evolving, and ranging from simple to very complex. Although I am not a victim advisor, I have been constantly surprised at what ITRC Victim Advisors do each and every work day to help this unending stream of victims.

A victim advisor for the ITRC never knows what the next call will bring. The phone rings according to your position on the phone queue, and now it becomes your call, your turn to listen, assess, question, analyze, discuss, and plan. Hopefully you can make some sense and order out of a victim’s pain and suffering at the hands of an identity thief. The training and preparation to become an identity theft Victim Advisor is by itself daunting. Each person I have seen trained for the job soon shows the signs of “information overload” as they begin to understand the breadth and depth of the information that must be understood and retained in order to appropriately answer that ITRC Call Center phone.

ITRC provides information and help on a wide variety of identity theft cases, scams, and related topics. Identity theft cases can be financial, government related (SSN and DMV), medical, criminal, child related, or Internet/account takeover types of cases. Each of these types of cases will require different actions to correct. In many cases the appropriate response, that will actually do some good, may vary depending upon the laws of the state of residence. And, as if that wasn’t enough, a significant percentage of these callers will have more than one type of identity theft to resolve. In the period January through August 2012, 28% of the victims reported governmental identity theft, usually meaning the illicit use of their SSN in some manner. Approximately 6 out of 10 reported financial identity theft. It is relatively common for a single victim to have financial identity theft at the same time they are a victim of governmental identity theft. Since there are many “sub-types” to each of these major categories, the Victim Advisor has the task of sorting out all the facets of these cases, and determining the appropriate course of action for each.

In addition, victims of identity theft are often very emotional and upset with this unexpected and serious invasion of their privacy. Some need to vent, and most have also been frustrated with endless phone trees, conflicting website information, and probably have found little coherent help with their specific problem. The Victim Advisors deal with a wide variety of personalities, including a few that simply don’t want to help themselves, and expect “someone else” to fix the problems. It is a saving grace that for most of the victims who contact the ITRC this will be their first time to speak with a live person, who is interested in their specific case, and has the knowledge to provide a good roadmap of actions to begin mitigating the problems.

So, I continue to be impressed by what the ITRC Victim Advisors do, and how they do it. In the field of identity theft, they are “in training” every day as exploits used by the criminals are constantly evolving. And it is always a great payback when a victim calls or emails, thanking our advisors for what they do.

Recently at the ITRC, there have been several curious consumers who’ve contacted us asking how they can be more proactive protecting their privacy when they surf the web. Well, we like to give the consumers what they want, so here are a few tips on how you can control your privacy while you use your Google Chrome Web Browser:

privacyFirst, in order to set your privacy settings, you must find the privacy settings. When you open your Google browser, find the button at the far top right of the screen,  just beyond the URL/address bar; the one that has three horizontal lines. Click that button and a drop down menu will show. Select the 4th option from the bottom that says “settings.”

This will open your settings within the webpage space itself. Find the blue hot link all the way at the bottom that says “show advanced settings.” This will prompt a longer menu to drop down, where you will see some basic privacy preferences like “enable phishing and malware protection” or “offer to save passwords I enter on the web.” These settings are preset by Google and generally speaking the default settings are appropriate for most users.

The most important area to focus on is a button immediately below the “Privacy” headline that says “content settings.” This button takes you to the meat of web browser privacy. In this subsection you’ll find the setting tables for things like internet cookies, pop-ups, location, plug- ins, and handlers. Examine this section carefully and select the settings that most conform to your level of concern.

Some people don’t mind having their web activity tracked by advertisers for the purposes of customized marketing, others do. The Google Chrome browser is highly customizable and easily adaptable in this way. Take a few minutes to examine your privacy settings, and have peace of mind next time you go online.

“How Can I Secure My Privacy on Google Chrome?” was written by Matt Davis. Matt is a Victim Advisor at the Identity Theft Resource Center. We welcome you to post/reprint the above article, as written, giving credit to and linking back to the ITRC Blog.

When most people think of identity theft they think of a thief opening up fraudulent accounts under their name and information, charging huge amounts of money. What a lot of people don’t consider is the possibility of a thief gaining access to their own credit reports and learning about where they have credit. If you find that somebody has pulled your credit report without your permission, don’t panic. Stay calm, there are things you can do to protect yourself.

The first is to get a copy of your credit reports yourself if you don’t already have one. This can be done by placing a 90 day fraud alert on your credit report by phone, by visiting the three credit reporting agencies’ websites, or by writing to the three credit reporting agencies if you are having problem with the phone or internet. Credit report

Once you have your credit reports you can see all of the companies that currently have accounts under your social security number, and if the thief has started any new accounts.

For lines of credit that are your own, call or physically go to these companies and talk to them about precautions and protections that can be placed on your account to prevent fraud. Most companies will offer a password or pin code for you. In cases of credit cards and some bank loans, you might want to consider changing the account number to make it more difficult on a potential thief. If you have any credit card accounts that you do not use regularly you may want to consider closing them. Make sure you have documentation showing when you have closed any line of credit reported with the CRAs.

If a fraudulent line of credit has been opened by the thief, read Fact Sheet FS 100 on the Identity Theft Resource Center’s website. It will walk you through what to do. After you have secured all of your accounts, consider freezing your credit reports. This will prevent the thief from viewing them again as well as establishing new accounts under your information. You can read about freezing from the Identity Theft Resource Center’s Website., Fact Sheet FS 124.

For continued vigilance, keep track of all statements (mailed or electronic) and watch everything for new activity or charges. Make sure all accounts that are supposed to be closed stay closed. Check your credit reports every year to make sure that everything remains ok and when in doubt, contact the Identity Theft Resource Center at 888-400-5530 for a free phone consultation.

If you found this information helpful, you may want to consider taking part in the Identity Theft Resource Center’s Anyone3 fundraising campaign.  For more information or to donate please visit http://www.idtheftcenter.org/itrc-launches-anyone3-campaign.

With all the high-tech ways that hackers and identity thieves can help themselves to your money, it’s easy to forget that the “old school” methods are still a very real threat. Things like dumpster diving for your discarded credit card offers or stealing your mail from your curbside mailbox still carry the possibility of a crime.

One viable method of wreaking havoc with your identity is to have your purse or wallet go missing, either through loss or theft. If that occurs, your checkbook can provide an opportunistic thief with a short-lived but still hefty payday.

If you notice that your checkbook is missing, there are some important steps you should take:

1. Is it lost or stolen?

This can be hard to determine, but if you’re able to tell whether it was just misplaced (maybe your wallet fell off the roof of your car when you drove away) versus actively stolen, your next appropriate steps can change. If you’re certain it was just dropped or left behind somewhere, call your bank and have those check numbers invalidated. If you aren’t certain about the numbers in your checkbook, they may be able to help you trace back which numbers you’ve already spent, and go from there.

2. Placing a freeze

If you can’t figure out the numbers or if you aren’t certain this was an accident, your bank might put a freeze on your account. It’s temporary but immediate, and it can prevent a thief from spending money in your name. That’s why it’s important to contact your financial institution as soon as you know something’s wrong.

3. Closing the account

Ultimately, your bank may decide that closing the account is the best option, especially if someone got a lot of checks or your bank cards. They will usually meet with you to determine which pending transactions are valid, such as any automatic bill pay items like your power bill, and help you establish a new account.

4. Transfer those draft payments!

If you do have to open a new account, make sure you think about all of the automatic draft payments you have, such as utility bills, gym memberships, or other recurring items. You don’t want a constant reminder of this headache every time your electricity is shut off or your membership expires for non-payment.

5. Decide if a police report is warranted

If you think you might have just lost your wallet, you might not need a police report. However, it’s a good idea to contact your local law enforcement office anyway and let them determine if you need to file any paperwork. After all, the person who finds your missing wallet might not be honest and could use your identification or your cards for fraud. If you do know that it was stolen, then you definitely should alert the police and file a report.


If you think you may be a victim of identity theft, contact the Identity Theft Resource Center for toll-free, no-cost assistance at (888) 400-5530. For on-the-go assistance, check out the free ID Theft Help App.

It has been a particularly disturbing couple of weeks as headlines throughout America highlight how some of our most powerful financial institutions were being hacked by alleged foreign powers. It all began on September 17 when the FBI issued a joint Bank Fraud Alert with the Financial Services Information Sharing and Analysis Center (FS-ISAC) and the Internet Crime Complaint Center.

whitehouse hackedThe Bank Fraud Alert warned banks and financial institutions that hackers were using Distributed Denial of Service (DDoS) attacks to take down their consumer websites to distract both the consumers and bank cybersecurity while millions of dollars were fraudulently wired out of peoples’ accounts. The very next day, Bank of America was reported to have website problems and consumers were having trouble accessing the website and their bank accounts.

On September 19, J.P. Morgan Chase Bank was reported to have similar problems as their website went down and consumers could not access their bank accounts. That same day, FS-ISAC raised its Current Financial Services Cyber Threat Advisory from “elevated” to “high” for the first time in its history. A few days later on September 25, Wells Fargo suffered website outages followed by website problems for U.S. Bank and PNC Bank the next day.

A hacker group by the name of Izz ad-din Al qassam Cyber Fighters has been claiming responsibility for these DDoS attacks, but experts warn that it is more likely that an organization with far more money and capabilities is responsible for these attacks. Senator Joseph Lieberman, Chairman of the Homeland Security Committee, stated in a C-SPAN interview that he believed Iran’s government sponsored the cyber-attacks.

Now, the Washington Free Beacon reported on Sunday that alleged Chinese government hackers had breached a computer system associated with the White House Military Office. A White House official confirmed that hackers had breached an unclassified computer network, but emphasized that the network had no unclassified information and no data appeared to have been stolen.

Apparently, the breach was made possible by a spear phishing attack, which involves the use of a message that appears to be authentic and contains a file or link to be clicked on which then installs malicious software onto the computer. The Senate blocked the Cybersecurity Act of 2012 in August which was designed to help bolster cybersecurity in critical infrastructures in the United States, leaving the Obama administration to consider issuing an executive order to improve cybersecurity instead.

“First the Banks, Now the White House” was written by Sam Imandoust, Esq. He serves as a legal analyst for the Identity Theft Resource Center. We welcome you to post/reprint the above article, as written, giving credit to and linking back to the ITRC_Blog.

Identity theft is a term now common in the American vernacular. Though the term is familiar, what it represents is often misunderstood by large segments of the consumer population. Many people commonly associate the term with someone making illegal use of a credit card number. By most current definitions however, that type of crime is more properly referred to as credit card fraud and is no longer considered a true example of identity theft. So what exactly does the term “identity theft” mean?

The best working definition of true identity theft is simple: The improper or illegal use of someone’s personal identifying Information (PII). It’s that simple. PII is defined as any information that uniquely identifies you as you. More specifically, your social security number, passport, birth certificate, driver’s license or state ID card, and similar documents that alone, or in combination, are unique to you as a person. ITRC considers that your PII can be used to commit several different types of identity theft. We classify these as five (5) basic types of identity theft: financial, criminal, medical, governmental, and cyber/reputational. There is also child identity theft, but other than the age of the victim, these are always one or more of the 5 types above.

  • Financial: Financial Identity theft is simply when someone uses another’s PII for financial gain. This can include using a SSN to open a new line of credit, a utility bill, a student loan, etc. Unlike the unlawful use of an existing, and legitimate credit card, these new fraudulent accounts may exist for extended periods of time before the victim becomes aware of them. Checking your credit reports or getting a call from a collection agency are two of the most common ways financial identity theft is discovered. Victims should file a police report and then dispute any fraudulent charges with the various affected merchants and creditors.
  • Criminal: Criminal Identity Theft occurs when someone has successfully impersonated the victim when dealing with law enforcement. This can be accomplished a multitude of ways. The most common is when a thief uses a victim’s SSN, Name, and perhaps date of birth to acquire a driver’s license. In the event this thief is cited or arrested by a member of law enforcement, the thief will pretend to be the victim thereby creating a fraudulent criminal history for the victim. Victims of this form of ID theft should have their local police fingerprint and mug shot them, and when appropriate send that information to whatever the arresting or citing law enforcement might be, so they can get issued a letter of clearance from the court, clearing them of responsibility.
  • Medical: This form of identity fraud occurs when a criminal makes use of the victim’s PII (such as an SSN or Medical insurance card/number/Medicare card etc.) to receive medical treatments and benefits and then leaves it to the victim and their insurance carrier to pay the bills. These events may also leave mixed medical records, which can be a significant problem to the victim. There is also a growing trend used by illegal pharmaceutical sellers as well as prescription pill addicts to use someone’s identity to steal prescription drugs without leaving a paper trail back to them for anyone to follow. Victims of medical identity theft need to get in touch with their insurance provider as well as the place where the procedures were performed, or where the medical supplies/drugs were purchased, and inform them of the fraud. This should include showing proof of that this misuse was brought to the attention of law enforcement.
  • Governmental: This is when the victim’s PII is used to acquire government benefits that the thief would not otherwise be entitled to. Things like government grants and loans, welfare assistance, even a large tax return a victim might be owed from the IRS are all strong motivators for criminals. Often those in this country illegally will have reasons to engage in governmental Identity theft in order to find gainful employment, or avoid detection. In addition to previously listed steps, victims should request an “earnings history report” at their local branch of the Social Security Administration. This report will show where someone has been working, and can be useful in mitigating the fraud.

Cyber/Reputational identity theft is the newest emerging form of identity theft. This involves the use of one’s name, likeness, online passwords or other associations in order to exploit or damage one’s reputation, or perhaps to gain access to their contacts or emails, or just to spam someone’s online relationships with advertisements or Trojans. Mitigation for this type of theft is best done through contacting the site administrator. (i.e. for a fraudulent Facebook profile, the only way to resolve the issue is through dealing with Facebook staff directly).

For additional questions or concerns, please contact the ITRC. ITRC provides no-cost toll-free assistance to consumers and victim at (888) 400-5530, or itrc@idtheftcenter.org.

“Classification to Mitigation: What You Need to Know about the Multiple Faces of Identity Theft” was written by Matt Davis. Matt is a Victim Advisor at the Identity Theft Resource Center. We welcome you to repost the above article, as written, giving credit to and linking back to the ITRC Blog.

Last week someone in my family asked me if I could help them with their computer. I asked them what was seemed to be wrong with the machine. They told me that it would start normally at first, but as soon as Windows was done loading they would get a pop-up that they had been infected with a virus that was above the level of what their normal anti-virus could handle. They were told that they needed to pay for this additional coverage to remove the problem. Unfortunately, they continued, and paid for the “extra service.”

This person, like so many of us, is not stupid. In fact, they are very intelligent. However, what is taken for granted as basic computer safety knowledge by theransomware younger generations is may be an unknown area of knowledge to those who never created a Word document for a paper in High School, never had a Facebook account that their parents monitored, and were never taught even the fundamentals about Cybersecurity. Today, when the Internet is no longer an option but a necessity for most of us, cyber criminals are finding an easy target in people who may be using the Internet and a personal computer for the first time.

I asked this family member if they had current updated anti-virus security on the computer, and they were not quite sure what I was talking about. This I could believe, as many people who were raised in the age of Internet still don’t know the importance of having an anti-virus with updated virus definitions installed on their computers. Good antivirus programs are perhaps the best way to protect yourself (and computer) from many of the threats, including viruses, malware, and cybercrime exploits. This ounce of prevention can save people from spending a pound on a cure.

Unfortunately for my family member, it was “too little, too late” for the prevention approach, and they had to take their computer in to have it fixed. This one event cost much more than an anti-virus program would have cost, not to mention the money paid to the Cybercriminals behind the Ransomware, and the time and frustration of the related computer problems. While it comes as little comfort to my family member now, this story has taught a lesson; use an anti-virus, and keep it up to date, always.

This experience also shows how easy it is to fall for the Ransomware scams, and how important it is to educate people about the current Cybercrime trends. Perhaps the next family night we will not be breaking out the Scrabble, but instead a Power Point presentation on Cybersecurity.

If you found this information helpful, you may want to consider taking part in the Identity Theft Resource Center’s Anyone3 fundraising campaign.  For more information or to donate please visit http://www.idtheftcenter.org/anyone-3.