Hackers have hit the computer systems of South Carolina's department of revenue, compromising 3.8 million social security numbers and nearly 400,000 credit and debit card numbers.
The department says that it suffered a data breach in September, exposing all people and businesses to have filed South Carolina tax returns since 1998. As well as 3.8 million social security numbers and 387,000 card numbers, 657,000 business tax filings are also affected.
Says a statement: "Of the credit cards, the vast majority are protected by strong encryption deemed sufficient under the demanding credit card industry standards to protect the data and cardholders. Approximately 16,000 are unencrypted."
The State is urging anyone who has filed a South Carolina tax return since 1998 to sign up for free to Experian's ProtectMyID Alert to receive credit monitoring for a year. By yesterday morning, Experian says that it had already received around 620,000 calls from potential victims and signed up 418,000 people to its programme.
Meanwhile, an investigation has found that several attempts were made to probe the department's systems but "on October 20, the vulnerability in the system was closed and, to the best of the department's knowledge, secured".
However, Andy Kemshall, CTO, SecurEnvoy, warns: "US credentials such as the person's social security number, name, address and payment card details, are pure gold when it comes to identity theft information, which has now become a global cybercriminal commodity business."