> series: anatomy_of_a_breach —— part: 046 —— target: south_carolina_dor —— ssns: 3,600,000 —— encryption: none<span class="cursor-blink">_</span>_
In October 2012, South Carolina Governor Nikki Haley disclosed that the state's Department of Revenue (DOR) had been breached and that attackers had stolen 3.6 million Social Security numbers, 387,000 credit and debit card numbers, and 3.3 million bank account records — all belonging to South Carolina taxpayers. The data was stored unencrypted. The breach was traced to a spear-phishing email that compromised an employee's credentials, providing the attackers with access to the tax database.
When asked why the Social Security numbers were not encrypted, Governor Haley stated that encryption was 'not prior to this legally required' — a defence that highlighted the gap between legal minimum requirements and actual security needs. The breach cost the state over $20 million in response, remediation, and credit monitoring for affected taxpayers, and led to mandatory encryption requirements for state agencies. The incident parallels the HMRC breach — a government tax agency holding millions of citizens' most sensitive financial data without the most basic protective controls.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe attack began with a phishing email to a state employee. The email delivered malware that captured the employee's credentials, which were then used to access the Department of Revenue's systems. From there, the attackers accessed the tax database and exfiltrated millions of records. The attack chain was identical to the pattern that began the RSA SecurID breach: phishing → credential theft → database access → mass exfiltration.
Governor Haley's statement that encryption was not legally required illustrated the dangerous mindset of treating legal minimum requirements as security targets. Legal compliance is a floor, not a ceiling. The HMRC breach taught the UK this lesson in 2007. The South Carolina breach taught the same lesson in the US five years later. The organisations that avoid catastrophic breaches are the ones that go beyond legal minimums to implement proportionate security controls.
Cyber Essentials certification provides a baseline that exceeds most legal minimums — including encryption, access control, patching, and MFA requirements. Our penetration testing identifies the gaps between what the law requires and what security demands. SOC in a Box provides the monitoring that detects breaches before millions of records are exfiltrated. And UK Cyber Defence provides the incident response capability that turns a breach into a managed incident rather than a crisis.
<a href="/cyber-essentials">Cyber Essentials</a> goes beyond legal minimums. <a href="/penetration-testing">Penetration testing</a> identifies real-world risks. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors continuously. Because 'not legally required' is not a defence your customers, your regulator, or the ICO will accept.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call