South Carolina faults weak IRS standard in massive data breach

Gov. Nikki Haley has written to the IRS emphasizing the importance of encrypting Social Security numbers

South Carolina's governor faulted an outdated Internal Revenue Service standard as a contributing factor to a massive data breach that exposed Social Security numbers of 3.8 million taxpayers plus credit card and bank account data.

Gov. Nikki Haley's remarks on Tuesday came after a report into the breach revealed that 74.7 GB was stolen from computers belonging to South Carolina's Department of Revenue (DOR) after an employee fell victim to a phishing email.

People who filed tax returns electronically from 1998 on were affected, although most of the data appears to be after 2002, Haley said during a news conference.

South Carolina is compliant with IRS rules, but the IRS does not require SSNs to be encrypted, she said. The state will now encrypt SSNs and is in the process of revamping its tax systems with stronger security controls. She said she has sent a letter to IRS to encourage the agency to update its standards to mandate encryption of SSNs.

The lack of encryption and strong user access controls plus dated 1970s-era equipment made DOR systems ripe for an attack, she said.

"This is a new era in time where you can't work with 1970 equipment," Haley said. "You can't go with compliance standards of the federal government."

The report, written by the security company Mandiant, found that an employee's computer became infected with malware after the user opened a phishing email. The hacker captured the person's username and password, which allowed access to the agency's Citrix remote access service.

From there, the hacker installed various tools that captured user account passwords on six servers. The hacker eventually gained access to three dozen other systems. Mandiant wrote that the hacker used at least 33 unique utilities and malware, including password dumping tools, administrative utilities, batch scripts and generic database command utilities.

The hacker used a utility called 7-Zip to compress information, creating 15 encrypted archived files that, if uncompressed, contained 74.7 GB of data. The data was moved to another server within DOR before it was eventually moved to another system on the Internet, the report said.

The 23 stolen database files contained a mix of encrypted and unencrypted data, the report said. The hacker appears to have only obtained an encrypted key for the encrypted data, which could not be accessed. But there was plenty of other plain-text data.

The data included SSNs for 3.8 million tax filers and information on 1.9 million dependants, Haley said. Information belonging to 699,900 businesses was compromised, along with 3.3 million bank accounts and 5,000 credit card numbers, she said.

South Carolina has identified all of the victims, who will be notified by letter. The state is also working with Experian, which is monitoring credit information for victims.

As a result of the breach, DOR Director Jim Etter will resign effective Dec. 31. He will be replaced by Bill Blume, who is currently executive director of South Carolina's Public Employee Benefit Authority, Haley said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags South Carolina Department of Revenuesecuritydata breachencryptionExploits / vulnerabilitiesMandiantdata protectionmalware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?