SO MUCH FOR THE WHOLE “NOTHING COULD HAVE BEEN DONE” EXCUSE
S.C. Gov. Nikki Haley claims that “nothing could have been done” to prevent an unprecedented security breach at the S.C. Department of Revenue (SCDOR). However the agency refused to participate in a free network monitoring system provided by the state’s chief information officer.
It’s the latest example of how millions of dollars in cyber security tools and training paid for by Palmetto taxpayers went unused – and a direct contradiction of Haley’s prior claim that “there wasn’t anything where anyone in state government could have done anything to avoid” the breach.
Haley – who oversees SCDOR and has been pushing for expanded control over other state agencies – has yet to take responsibility for the egregious lapse in security or explain to the public why tighter security measures were not in place (including those utilized by virtually every other state agency).
“The South Carolina Department of Revenue chose to only have part of its network monitored,” reports Jody Barr of WIS TV 10 (NBC – Columbia, S.C.). “The networks SCDOR did not have the state monitor were the ones a foreign hacker stole 3.6 million South Carolina social security numbers from.”
That breach – which began on August 27 – was never detected by the state. In fact it wasn’t until October 10 – a month-and-a-half after the initial hacking attempt – that the U.S. Secret Service informed state leaders that their network had been penetrated. Amazingly, it took another 10 days after that for SCDOR to implement the enhanced security measures outlined above – and another week after that before Haley informed the public of the breach.
In addition to the Social Security numbers, nearly 400,000 credit and debit cards and tax information for up to 650,000 businesses were also lifted by the hackers – who are believed to be connected to an Eastern European crime syndicate.
Haley has been roundly criticized for her handling of the breach, including numerous inconsistencies and outright lies included in statements she has made to the press. Haley will also miss an upcoming cyber security panel – scheduled by S.C. Treasurer Curtis Loftis prior to the breach – due to her political schedule.
Haley’s administration experienced another major security lapse less than six months ago when nearly a quarter of a million Medicare records were improperly lifted from the S.C. Department of Health and Human Services (SCDHHS).
In response to the latest lapse, the state is spending $12 million to provide a year of free credit monitoring from Experian – but that decision is now being questioned on the basis of cost and security concerns.
***
40 comments
Hey Dumb@$$ FITS: There’s a BIG elction in 4 days, and:
Gas Shortages May Not End for Another Week…
Mile-long lines, price hits $6…
Fistfights, Guns Drawn…
Some Siphoning From Cars!
‘I’m pretty pissed’…
Two massive generators power NY media, not masses…
NYC Official: Red Cross ‘Absolute Disgrace’…
Looters Dress Like Con Edison Workers to Gain Access to Houses…
Staten Islanders Plead for Help: ‘We Need Food’…
‘Please don’t leave us’…
I thought you were trying to push this as a politics site…Why the FEAR of reporting something pertinent…???
I think we know why…
Didn’t Romney want to cut federal relief to these people?
I didn’t know Romney was in power of NJ or NY…
Nice try, anyway…you Blithering Dumb@$$…
Always BLAME somebody else for your failure…Typical…
And I didnt know that this website covered NY or NJ..or was supposed to..
dumbass
Staffer, that was old Romney. Remember the Etch-a-sketch. New Romney loves FEMA, so long as he is talking to people who love FEMA. In fact if you will just look at his record you will see he clearly liked FEMA before he hated FEMA, before he maybe liked it again; for now; at least while he knows he is being recorded.
Once again your comments are off topic. Why don’t you start your own site and stop bitching on this one?
Romney has been strangely quiet on his position regarding FEMA recently, that’s for damn sure.
I didn’t know Romney was in power of NJ or NY…
Chris Christie is in power at NJ, but you don’t seem to be bringing him up!
T, is trying to deflect the fact his queen is dumber than he is.
It cover most everything except the TRUTH, whenn FITS and his minions cannot face it….
Hey Smirks: NY and NJ is a Disaster…Why is FEMA not doing anything????
Looks like Romney is RIGHT…
Gee, Bigot, if you h8 Fits so much and have no respect for anyone on this site, why do you come here. That’s some big
masochistic complex you have.
And, you need to keep up. Both the NY Governor and the New Jersey Governor have PRAISED FEMA and the President.
Mittsie, on the other hand, packed a few bags of un-needed and un-wanted can goods in Ohio.
Yep. Mittsie. That’s your guy.
So not only did DSIT have to tell DoR that they were being hacked, they had also offered -FREE- network monitoring and DoR said no?
“Nothing could have been done.” I completely agree, nothing could have been done. Haley isn’t up for reelection until 2014.
Help from the Federal Government. We don’t need no help from the Federal Government. We’ll take care of our own security.
“Haley isn’t up for reelection until 2014.”
Which is why this state needs a recall process.
We in S.C. insist that the Feds keep the hands out of our lives and our government. Funny how the states that accept the help, play by the rules and look out for their people always excell, while S.C. continues to sink in it’s home-grown pile of manure.
Kind of reminds me of the warnings that went to the captain of the Titanic about icebergs in the ocean where he was headed. He had other things on his mind, an iceberg was hit and…well…you know the rest of the story.
Wow: It’s just getting WORSE for Obama…on the WORST possible weekend…
Drivers Waiting 6 Hours For Gas in NYC…
Tempers Rise in Wake of Storm…
‘They forgot about us’…
CHUCK SCHUMER CONFRONTED: ‘We Are Gonna Die!’
CUOMO: ‘No reason to panic’…
Utility workers pelted with eggs…
Misery…
Mile-long lines, price hits $6…
Residents Furious RED CROSS Offering Cookies & Hot Chocolate, Not Blankets Or Clothes…
Two massive generators power NY media, not masses…
Staten Islanders Plead for Help: ‘We Need Food’…
‘Please don’t leave us’…
VIDEO: Stranded New Yorkers Defecating in Apartment Buildings…
DIRE…
And FITS Cowers….
And all you can do is shoot your ugly mouth off! If you’re so damned concerned, get your ugly ass into your car and drive north and help with the cleanup! That’s what hydro workers from surrounding states are doing right now. Of course it’s always easier to sit at your keyboard and bellyache about things you know fuckall about!
All he can do is copy/paste editorialized headlines from Drudge, actually.
If NJ is a mess, let’s hear Big(o)T bash Christie. Some among the GOP have already started. Come on, fair’s fair, right? He’s even praised Obama, so he’s asking for your wrath! Let’s hear it!
“Wow: It’s just getting WORSE for Obama…on the WORST possible weekend…”
People are suffering and all you can think about is how it looks (in your head) as a nail for Obama? You’re one sick, sadistic Big bag of shitT. Assholes like you call for Christie’s head for helping people instead of playng partisian pawns. I’m not the biggest fan of Giuliani, but damn did I admire his leadership. So fuck yourself and have a shitty weekend.
Well said, Isotope, and thanks.
t, you had me going for a minute ….. I thought you were talking about what happens to the straight employees in the rest rooms at the DOR with their total lack of management!
I have a friend here in South Carolina who owns his own business and is a webmaster. He knows IMMEDIATELY when someone is trying to hack into his system. They didn’t know IMMEDIATELY in August that someone was trying to hack into SCDOR’s computer system. WHAT IS WITH THAT????????????? And, then it took the Secret Service to have to tell them that they had been hacked??????????? How did the Secret Service know? And, if the Secret Service knew, they why the HECK didn’t they know???
For Haley to state that there was nothing they could do just seemed SO STUPID and TOTALLY INCOMPETENT to me.
Your network security appliance(s) should be able to warn you immediately when they detect potential high risk problems and should log anything else that is remotely suspicious. Normally you can have devices email or even text message you directly the moment something potentially bad occurs. You should also have people checking the logs on a daily basis.
Even if you concede that yes, you can’t defend against EVERY exploit out there, the fact remains that we were attacked multiple times across the span of over a month, and that the information was not stolen until the later attacks. If we had been paying attention to this shit, we would have known of a vulnerability and maybe could have stopped it before they stole the information.
SCDoR should have their own monitoring going on, and yes, they should have taken the FREE monitoring from DSIT.
From reports, it looks like the hackers were using the email/ID/password/authentication credentials of someone at the DOR……that is why it was not suspicious! Basically an insider job, by an outsider!
The dogs are sniffing around- and they’re getting closer! It may not be too long before they get their fangs on some red meat.
Sometimes you have to follow the hunter’s old saying – “you might have to feed the beast or it might turn and feast on you”
But Smirks, our Governor has said there was nothing that could have been done to stop the hacking. She wouldn’t knowingly be giving us inaccurate information, would she?
That is just f’ing insane! Why refuse network monitoring that South Carolina provides for free? Unless SC Governot Nikki Haley wanted something more than her taxpayer provided salary after four years in office.
Screw giving us Experian…the state offered Lifelock subscriptions to Medicaid recipients after the breach months ago…seems like that’s what they need to be offering here, but my guess is it’s cost-prohibitive.
SCDOR really wasn’t “hacked”. Someone at SCDOR either did not protect, or gave the credentials (or password) to a person who then strolled in to look around, and then took what they wanted. This was not hacking; SCDOR gave the person the key to the safe holding all the tax filing information. This person who asked, got the key and waltzed in is what Haley is calling an incredibly brilliant hacker. Is the “hacker” incredibly brilliant or are SCDOR and Haley incredibly stupid. This fiasco could have easily been prevented if SCDOR had not been so incredibly casual with the credentials (passwords).
Question: Is Haley’s story about having their identity stolen a few years ago an attempt to explain why her husband still owes a boatload of money to a bank? The debt was supposed to be because his business failed. Seems to me they are going to be spinning a tale that the debt was due to stolen identity.
So there was nothing monitoring where VPN connections were coming from? Or was there no VPN at all? Monitoring software wouldn’t be able to tell that someone was accessing HUGE amounts of sensitive data from outside? We are talking about 3.6 million SSNs, data from 1998 to 2011, businesses’ info, etc. Why did they have to call an outside company to close a loophole if all they needed to do is block out login credentials? Why were outside groups informing DoR if it was something that couldn’t be helped?
Fucking weak. Experts have ripped Haley apart on a lot of what she has spewed thus far. Monitoring software would have caught that much data being moved even if it didn’t stop it and even if the intrusion set off no immediate alarms. Someone was asleep at the wheel, or the network security team were not given the proper tools/training to do their jobs. Incompetent employees or incompetent managers, take your pick.
And, we would NEVER have known about this breach if the Feds had not notified SCDOR.
I suspect Haley wouldn’t have made the breach public if she had not been THREATENED by the Secret Service.
“Drivers Waiting 6 Hours For Gas in NYC…
Tempers Rise in Wake of Storm…
‘They forgot about us’…
CHUCK SCHUMER CONFRONTED: ‘We Are Gonna Die!’
CUOMO: ‘No reason to panic’…
Utility workers pelted with eggs…
Misery…
Mile-long lines, price hits $6…
Residents Furious RED CROSS Offering Cookies & Hot Chocolate, Not Blankets Or Clothes…
Two massive generators power NY media, not masses…
Staten Islanders Plead for Help: ‘We Need Food’…
‘Please don’t leave us’…
VIDEO: Stranded New Yorkers Defecating in Apartment Buildings…
DIRE… ”
Nothing in the above reflects on anything but uneven LOCAL preparedness.
When the storm got close they should have evacuated, just like New Orleans.
Now they are pissed at their own unpreparedness. There wouldn’t be GAS LINES if everyone had FILLED their fuel tanks before the storm hit and bought some extra fuel cans for reserve. A full tank is enough to LEAVE the area.
If I can do it they can do it, end of story. Any homeowner had time to get and store canned/dried rations, water containers, and other supplies in-place to cope for a month-ish interruption. Renters etc could still have prepared with food and other basics.
I’m from New Jersey, and the folks in urban areas don’t have a fucking clue.
They will now be TAUGHT clues by Nature.
Granted, they don’t get many hurricanes up that way, but it isn’t like an earthquake, they had time to go out and do something. Hopefully next time more people will heed the warnings and prepare themselves.
Listen people
She hired a bunch of kids to run this state. She and her twenty something friends and staff raise money and politic all day and drink all night.
With teenagers in charge why would you think the state would be well run?
Politics is like love. People suspend good sense when it comes to their politicos. Haley is incompetent and could care less about governing.
Get over it. turn her out of office and get a real leader.
I’m listening – preach it brother! You are spot on.
I am very sorry about the storm that destroyed so many lives & livelyhoods. I don’t want to seem to blame the victims, however, why didn’t people LEAVE WHEN TOLD! In TX we use to get less than 5 min., if we were lucky, to seek shelter for a entire county. Being in Tornado Alley that’s what we did! We hid, every spring we would review with our families what to do & where to go in the house to up their survivorbility. The women in the family go through their family’s Tornado Box to be sure everything works, 1st aid items & food are still within dates to eat & treat injuries. Now it’s so much better, our warning is up to 10-15 mins. But we still move our Tornado supplies to the safe part of the house just in case. Northerner’s have come to TX, OK,& KY & we as neighbors teach them, however, we still find them standing with their smartphone filming Tornados. I feel so bad for those on Staten Island, but good Lord! WHY DIDN’T YOU LEAVE?
BTW Romney has given so many different answers and views on so many important issues that could get us in another war, mishandle our funds,& poss. the control of our bodies. He’s not trustworthy cause he is all over the map, never taking a stand that he couldn’t step off of because someone found a negative, yet legitimate, issue with major policies he would enact. I haven’t heard a single issue that he hasn’t changed direction. Global warming is tearing our weather patterns apart. All of the prominate sciencist who said Global warming didn’t exist have changed their mind & say it is REAL. Romney wants to increase drilling oil instead of building protective sea walls or alternate energy sources. Obama isn’t perfect, but if you will noticed the closer we get to decision day the more he is taking the same line that Obama made 4 yrs ago. Romeny has never heard of a idea that he wouldn’t steal, he hasn’t found an issue that Obama didn’t do (jeep) that he wouldn’t stoop so low to scare hardworking Americans with to get a vote. The only ones I know of from history to the present who rule by fear are Dictators. So ask yourselves, if he can lie and stoop to fear mongering so fluidly now, what does that say about him? Obama said recoverey wasn’t going to easy & it hasn’t been. NO president could have gotten us out of the mess that Bush got us into. I KNOW, HE WAS THE GOVENOR IN MY HOME STATE & BUSH WAS CROOKED THEN! So also ask with Sandy’s massive recovery who do you want on yourside? Possible lost insurance because your work blew away, perhapse one of your kids lost his job & had a birth defect,pre-existing condition, so sorry. That’s what happened to us.
The two-bit oligarchy and goober-feudalism “upper crust” and elected tribal chiefs and petty warlords of South Carolina do not want well-run professional agencies. Professionals then would make good and legal decisions based on merits. Thw petit-powerbrokers want total influence, they want lackeys. Those nearly incompetent will do just fine. No-account and otherwise unemployable relatives are even better.
Well sometimes the chickens come home to roost.
And all this is not new:
http://educatingsouthcarolina.blogspot.com/2011/07/purge-of-doe-employees-recalls-ferguson.html
SC doesn’t demand performance in agencies; it doesn’t even want performance in agencies.
Fact : DoR servers are at the vaunted DSIT. In fact they are basically right under the very people who monitor the activity at DSIT. Even though thorough monitoring was not in place, DSIT did in fact monitor some of the activity as evidenced by the reference to notifying DoR of a virus previously. I would be asking why all this money at DSIT results in a breach of this size in their own building. Yeah let’s let these a$$ clowns build a state cloud so that ALL of the data could be compromised right under their noses. The state CIO is a bureaucrat not an IT person. DSIT has to pay vendors to install and configure all their equipment. Ask them about their backup process for the SCEIS system and how it went without backup for a long period.