South Carolina Department of Revenue Data Breach: What Went Wrong
May 19, 2013

In November of 2012 the South Carolina Department of Revenue Suffered a Major Systems Breach. This data breach lead to over 3.8 million South Carolina and 1.9 million dependents having their Social Security numbers with over five thousand credit card and bank account information exposed to hackers (Westin,20012) . Along with this vital information this hacker or hackers gained access to over 44 servers, and installed 33 pieces of malicious software or malware for short (Westin, 2012). By, the hackers installing the malware on to the servers the hackers where able to go undetected by the department of Revenue, until the local law enforcement brought evidence to the attention of the director about a few identity theft cases (Westin, 2012). After a serious system breach such as this one the victims and the public want to know how could this have happened? After an investigation is was discovered that the hackers gained access to the system due to an employee opening a virus infected email. This is also called a Phishing attack. These types of attacks happen when hackers send fake emails with mal ware and spyware attached to it (Security 4 Web). Upon opening this email the employee unknowingly let a hacker into the data systems allowing them access to all personal and financial information to the citizens of South Carolina. Along with the Phishing Attack There are other factors that were involved such as lack of security controls. When there is a lack of security controls opportunity is revealed to commit a crime. Internal controls perform three important functions, Preventative, detective, and corrective. Unfortunately The Department of Revenue’s internal control system wasn’t strong in two of these important functions. An increase in preventative controls would have stopped the