S.C. taxpayers’ Social Security numbers, credit cards hacked

The South Carolina Department of Revenue is providing affected taxpayers a year of credit monitoring after a hacker stole information including 3.6 million Social Security numbers and 387,000 credit and debit card numbers from its computer systems.

State revenue officials announced Friday that the S.C. Division of Information Technology learned of the electronic intrusion on Oct. 10. State officials were first alerted to it by a U.S. Secret Service electronic crimes task force.

An initial attempt to enter the system came from a foreign internet address in late August. The Department of Revenue said in a news release that several more attempts occurred in September, when a hacker gained access to the data from tax returns going back to 1998. Officials finally secured the system on Oct. 20.

Officials said they have beefed up data security and are continuing an investigation. As of Wednesday, no further breaches were known, and no one had been charged or publicly identified as behind the attack.

Officials said they knew of no thefts from individuals whose data was compromised and said most of the data from credit and debit cards were encrypted—cards recorded since 2003, representing 371,000 of the 387,000 total. The Social Security numbers, however, were not encrypted. Investigators were still trying to determine what other information might have been stolen and from what types of returns, said Samantha Cheek, public information director with the Department of Revenue. Besides personal income tax returns, South Carolina returns potentially affected could include those for sales taxes and state income tax withholding, she said. Cheek said she did not believe corporate tax filings were known to have been affected but that some business information on other returns may have been compromised.

South Carolina is offering free credit monitoring and identity protection to all affected taxpayers. Anyone who filed a South Carolina tax return since 1998 can call 1-866-578-5422 to learn whether they are affected and, if so, enroll in the protection. On the web, taxpayers can go to protectmyid.com/scdor and use the authorization code scdor123. The service includes a free credit report; daily monitoring of all three major credit bureaus, with alerts of any suspicious activity; and $1 million in insurance against identity theft.

CPAs in South Carolina are “getting inundated with phone calls and emails from their clients” about the situation, said Erin Hardwick, CEO of the South Carolina Association of CPAs.

“They’re hearing on the news that their tax information has been compromised, and they automatically think, ‘I need to call my CPA.’ ”

The state association, in turn, has been receiving members’ questions and has been acting as an intermediary with state officials. The association plans to post information it obtains on its website, scacpa.org, for its members.

One worry is that the breach might make taxpayers leery of efiling, Hardwick said. But for the upcoming filing season, it might actually help tax preparers deal with a too-familiar problem.

“It’s an opportunity for members to encourage their clients even more strongly to do early filing for their 2012 returns, so once they get it in, it’s less likely someone would file a fraudulent return,” she said. “I honestly think this might be the year for clients to listen to that.”

—Paul Bonner (pbonner@aicpa.org) is a JofA senior editor.