Er.Prince Bhalani: SCDOR hacking may not have been preventable

Security breach puts millions of people at risk

SC Department of Revenue was hacked

Gov. Nikki Haley says new layers of security are being added in the wake of a massive security breach, but she said at a news conference Wednesday that even with what is now known, there is "no way to say it could have been prevented."

The massive security breach at the South Carolina Department Revenue could earn the hackers as much as $360 million by using just 1 percent of the affected taxpayers returns, the State newspaper is reporting.

Last month, state officials revealed that more than 3.8 million personal tax returns and 657,000 business returns were accessed in a cyberattack.

Investigators believe that a hacker tricked someone at the Department of Revenue into opening a file that gave the hacker access to the system.

At the news conference, Haley said that she has issued a second executive order that calls for cabinet agencies to be monitored 24-7.  The monitoring will require the addition of four fulltime employees, with the cost of their salaries split by five cabinet agencies.

She said another layer of security will be provided by a piece of equipment called The Hand that is being purchased from the computer forensics and security company Mandiant at a cost of $160,300.  She said the Hand will detect any movement of large files and will shut any effected machines down immediately and contact Department State Information Technology.

The Hand agreement covers up to 100,000 computers, but Haley said if more state agencies and computers are moved under the security umbrella, the agreement with Mandiant can be modified to include more computers.

DSIT will also monitor traffic patterns in real time to be sure no data is taken from the network.

Officials said that typically a hacking attack affects individual machines, so the security measure would never shut down the whole network.

Haley skipped the annual Republican Governors Association.  Her spokesman, Rob Godfrey, said Wednesday Haley decided not to attend the association's biggest event of the year, held Wednesday through Friday in Las Vegas.

Anyone who has filed a tax return in South Carolina since 1988 is encouraged to take precautions to prevent identity theft.

Those affected are urged to call 1- 866-578-5422, to determine if you want to have an online or US mail alert mechanism.  For the online service, visit   protectmyid.com/scdor The code is:  scdor123  (For the US Mail service, you will receive notifications via the US mail.)

Other services that can put fraud protection on your accounts are: Experian: 888-397-3742, Equifax: 800-685-1111, TransUnion: 800-680-7289

Taxpayers can enroll in one year of free identity protection service provided by Experian. The call center is open from 9 a.m. to 9 p.m. Monday through Friday. On the weekends it is open from 11 a.m. to 8 p.m.

Experian’s ProtectMyID™ Alert is designed to detect, protect and resolve potential identity theft, and includes daily monitoring of all three credit bureaus. The alerts and daily monitoring services are provided for one year, and consumers will continue to have access to fraud resolution agents and services beyond the first year.

In addition to the Experian service, state officials urged individuals to consider additional steps to protect their identity and financial information, including:

• Regularly review credit reports
• Place fraud alerts with the three credit bureaus
• Place a security freeze on financial and credit information with the three credit bureaus

If credit card information is compromised, the best protection is to have the bank reissue the card. Anyone who has used a credit card in a transaction with the Department of Revenue should check bank accounts regularly to see if any unauthorized charges have occurred. If so, the cardholder should contact the credit card issuer immediately by calling the toll-free number located on the back of the card or on a monthly statement, tell them what you have seen, and ask them to cancel and reissue the card. Consumers should also change any credit card web account passwords immediately when unauthorized charges are detected.