As a result of the information security breach at the South Carolina Department of Revenue (SCDOR) that was detected on October 10, 2012, the Social Security numbers and business tax identification numbers of approximately 3.6 million South Carolinians have been compromised.
I have been appointed to the SCDOR Data Breach Investigative Committee by Speaker Harrell to examine why the breach occurred and to find a way forward that will keep our citizens’ personal information secure. Over the course of the last few weeks, we have learned that there are discrepancies among state agencies in information security policy. It is also apparent SCDOR was experiencing management issues that left key security positions open, while also having a period of questionable commitment to improving data security.
The General Assembly and the Budget and Control Board are working on policy plans and budgets to provide our citizens the level of data security they deserve. Unfortunately in the wake of the massive data breach that has occurred, I need to emphasize measures citizens can take to minimize the effects of this breach.
If you have filed a tax return in South Carolina since 1998, then your information was likely compromised. You could become the victim of identity theft. This means someone could potentially use your personal information to obtain credit, employment, medical treatment, benefits, goods or services illegally. In addition, the Social Security numbers of children and deceased persons may also be used by criminals for these or other purposes.
South Carolina has contracted with Experian to help protect citizens against identity theft by providing a free one-year membership in ProtectMyID. To register with ProtectMyID, log onto www.protectmyid.com and use the activation code SCDOR123, or call 1-866-578-5422 to complete the process with a live agent. If you choose to enroll via telephone, you will speak with a representative in the Experian Call Center. The deadline to register for the one-year free membership with ProtectMYID has been extended to March 31, 2013.
Once you have registered, Experian will provide you with a free copy of your Experian credit report, and you will receive alerts for any suspicious activity on your credit report. If you have been a victim of identity theft, you will be assigned a dedicated Experian Identity Theft Resolution Agent who will assist you with the entire resolution process. You will also be covered by a $1 million insurance policy, if you become the victim of identity theft. This policy can help you recover certain costs associated with identity theft. You will also have access to personalized assistance from a Fraud Resolution Agent even after your initial one-year membership in ProtectMYID expires.
Your minor children or dependants may also have had their information compromised. After you have registered for ProtectMyID you should enroll your minors in Family Secure coverage. Family Secure coverage provides monitoring of the minor’s identity for one year. The parent or guardian will receive an alert if there is any activity using the minor’s information.
Unfortunately, deceased loved ones can also become the victims of identity theft. In order to notify the credit bureaus of a family member’s death, you will need to obtain copies of the death certificate from the South Carolina Department of Health and Environmental Control. Then, you will need to draft a notification letter containing your name and contact information, and the deceased’s name, Social Security Number, date and location of birth, previous three addresses in the past 5 years, and date of death. Be sure to specify your relationship to the deceased and include a copy of the death certificate. Request that “Deceased, Do Not Issue Credit” be posted on the decedent’s credit report. This is a costly and cumbersome process, and I plan to file legislation to streamline it.
If you are a business owner, you may enroll free of charge with Dun & Bradstreet and Experian Business Credit AdvantageSM. To contact Dun & Bradstreet, go to www.DandB.com/SC or call Dun & Bradstreet at 1-800-279-9881. To register with Experian Business Credit AdvantageSM, go to www.SmartBusinessReports.com/SouthCarolina. Non-profits and churches are also affected by the data breach and should also register for these services.
Under current federal law, citizens have the right to place a free fraud alert and credit freeze on their credit reports. For information on how to do this, visit the SC Department of Consumer Affairs website at http://www.consumer.sc.gov/consumer/PressRelease/Documents/2012/12019.pdf.
It is important to recognize that credit monitoring is only one way to protect your information. It will notify you when someone is trying to apply for a credit card or a loan using your information. However, credit report monitoring will not catch fraudulent use of your credit card or bank account, check fraud, fraudulent tax returns, and a whole host of other identity theft crimes.
Although the information breach at the South Carolina Department of Revenue was a disaster for our citizens and our state, there are lessons to be learned from this unfortunate situation. It may be nearly impossible to protect ourselves from determined identity thieves, but we can be vigilant with our credit reports and our personal information. We are living in an increasingly digital age that requires new knowledge and tactics to keep our information secure.
While the state will be making changes to the way it handles our personal information, it cannot do what citizens can and should do for themselves when it comes to protecting this sensitive information. Please take the time to visit the South Carolina Department of Consumer Affairs’ website at http://www.consumer.sc.gov for detailed information on proactive steps to take to protect your information. You may also call my office in Columbia at 803-734-3044 to request a brochure on how to minimize the effects of a security breach.