South Carolina breach exposes 3.6M SSNs
Another 387,000 credit and debit cards also exposed in Department of Revenue intrusion, but most were encrypted
Computerworld - In the biggest data compromise of the year, Social Security Numbers (SSN) belonging to about 3.6 million residents in South Carolina have been exposed in an intrusion into a computer at the state's Department of Revenue.
Another 387,000 credit and debit card numbers were also exposed in the September attack, the state Department of Revenue said in a statement Friday. However, out of that number only about 16,000 of the credit and debit cards were unencrypted, the department added. The SSNs, meanwhile, do not appear to have been encrypted.
Anyone who has filed a South Carolina tax since 1998 has been impacted by the breach and will be offered one year of identity protection service from Experian. The service includes a $1 million identity theft insurance policy. (The state department has set up a Web page with contact information for people to call.)
"The number of records breached requires an unprecedented, large-scale response by the Department of Revenue, the State of South Carolina and all our citizens," South Carolina Governor Nikki Haley said in the statement. "We are taking immediate steps to protect the taxpayers of South Carolina, including providing one year of credit monitoring and identity protection to those affected."
The department said the data theft appears to have occurred sometime in mid-September. An ongoing investigation of the breach by security firm Mandiant shows that the perpetrators first made an attempt to break into the system and steal the data in August and twice again in mid-September. The hackers appear to have accessed the data during the mid-September intrusions, the department said in its statement.
The Department of Revenue first learned of the intrusion only on Oct. 10 after being notified about it by the S.C. Division of Information Technology. Federal and state law enforcement authorities were immediately informed about the breach and Mandiant was brought in the next day to begin remediating the situation. It is not immediately clear what systems were breached, or how.
Mandiant has closed the vulnerability that led to the intrusion and has finished installing surveillance and monitoring tools across the department, the statement added.
The breach is easily the biggest involving Social Security Numbers this year. The previous biggest loss of SSNs this year happened when hackers believed to be operating out of East Europe broke into a Medicaid server at the Utah Department of Health in March and accessed closed to 280,000 SSNs and close to 500,000 other records involving less sensitive personal data.
In that incident, hackers were able to gain access to the system by exploiting a default password on the user authentication layer of the system. The attackers were able to bypass multiple network, perimeter and application level security controls to gain access to the data. The incident prompted the resignation of Utah's CTO, a couple of months later.
It's too soon to say what kind of fallout this breach will have, especially considering the fact that the SSNs appear to have been stored in unencrypted fashion.
Security experts have long advocated the use of encryption to protect SSNs and other sensitive data and some states such as Massachusetts even mandate it. The fact that this basic precaution appears not to have been taken in this case could expose the state to potential lawsuits as well.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
- Snowden advocates at SXSW for improved data security
- Joomla receives patches for zero-day SQL injection vulnerability, other flaws
- NSA used 'European bazaar' to spy on EU citizens
- Target CIO resigns following breach
- Evan Schuman: Mobile IT Roach Motel: Data checks in, but it won't check out
- Sears finds no evidence of data breach -- yet
- Gameover malware is tougher to kill with new rootkit component
- Mobile app for RSA Conference exposes personal data
- UK man charged with hacking Federal Reserve
- Bloomberg clamps down with data-access policies after scandal
Read more about Data Security in Computerworld's Data Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Top tips for securing big data environments - Why big data doesn't have to mean big security challenges Organizations don't have to feel overwhelmed when it comes to securing big data environments. The same security fundamentals for securing databases, data warehouses...
- Top 3 Myths about Big Data Security : Debunking common misconceptions about big data security Big data represents massive business possibilities and competitive advantage for organizations that are able to harness and use that information. But how are...
- Three guiding principles for data security and compliance Data security is a moving target-as data grows, more sophisticated threats emerge; the number of regulations increase; and changing economic times make it...
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva.
- How SIEM Addresses the Challenges of Big Security Data This webcast will help you understand today's big data security challenges and how intelligent and scalable SIEM solutions give IT the tools and... All Data Security White Papers | Webcasts