COLUMBIA, S.C. - State and federal officials say an international hacker broke into the South Carolina Department of Revenue computer files and gained access to about 3.6 million tax returns.
Gov. Nikki Haley said the hacked files included state returns submitted since 1998 with unencrypted Social Security numbers. There also were about 387,000 credit and debit card numbers of which 16,000 were unencrypted.
State and federal officials confirmed to our sister station WLTX that one of the South Carolina Department of Revenue's servers was hacked by someone in a foreign country.
The agency is responsible for 32 separate state taxes, licenses, and state income tax returns.
Related Coverage: Gov. Haley: 'I Want Him Slammed Against a Wall | State Had Signs Beforehand |Cyber Attacks Continue Worldwide |Governor's Executive Order on Cyber Security
The first breach occurred on August 27 although no information was apparently taken at that time. On October 10, the SC Division of Information Technology informed the Dept. of Revenue of a potential cyber-attack. On October 16, investigators uncovered two attempts to probe the system from September. In mid-September, two other intrusions occurred, and the hacker got data for the first time.
The extent of the breach was massive: an estimated 3.6 million Social Security numbers and 387,000 credit and debit card numbers were exposed. Just 16,000 of these credit card numbers were not encrypted; however, none of the Social Security numbers were.
For perspective, there are almost 4.7 million South Carolinians, according to the 2012 U.S. Census, meaning three out of four people's Social Security numbers were compromised.
State Law Enforcement Division Chief Mark Keel told WLTX that this is one of the biggest investigations he has ever been a part of in his career.
They have been working to secure taxpayers' information. The state is offering credit counseling to those affected. Anyone who has paid taxes in South Carolina since 1998 should call 1-866-578-5422. Alternately, you can request an access code to use at www.protectmyid.com/scdor.
Mandiant, a top information security company, says they are assisting in the investigation. They are also helping to secure the state's system, and are installing new equipment and software.
Meanwhile, Governor Nikki Haley promised action against the person responsible. "I want that man just brutalized," she said. "I want him slammed against the wall."
Haley issued an executive order where she outlines areas where she wants the state's cyber security to improve.
Officials said people whose information has been compromised will get a free year of identity protection service provided by Experian and paid for by the state.
Contributing: Associated Press