“Hackers penetrated the computer defenses of South Carolina’s Department of Revenue and accessed 3.6 million social security numbers and account data for 387,000 payment cards, officials said. The Associated Press reported the intrusion also exposed citizens’ tax returns, which typically contain much more sensitive personal information, but that couldn’t immediately be confirmed.”
The breach, which occurred in mid-September, followed a series of attempted intrusions beginning in August, according to a press release. State officials have known of the data breach since October 16, and suspected an intrusion as early as October 10, but didn’t disclose it until Friday, just hours before the start of the weekend. The underlying vulnerability that attackers exploited to access the state network was fixed on October 20.
On the positive side, Officials said people whose information has been compromised will get a free year of identity protection service provided by Experian and paid for by the state. It wasn’t clear how much that would cost the state.
Original article by Dan Goodin at ArsTechnia