SC Department of Revenue Hacking: A Second Look

http://www.dreamstime.com/-image13309768

Since SC Taxpayers’ information has been hacked by criminals, what can businesses do to protect themselves from hackers?  While most organizations have network security with firewalls, firewalls may no longer be enough. It is easy enough for an experienced hacker to break through a firewall. More security can help, as well as knowing who is vulnerable to hacking and how the hackers operate.

If you are hacked, timing is critical.  The sooner you discover that you may have been hacked, the better. The SC incident points out that the time from the actual hacking to the notification was due in part to a lack on the part of SC’s ability to discover the hacking themselves—the Secret Service made the discovery.  

What can you do to beef up your security to protect against these crimes?

First, businesses need to be scrupulous about monitoring their internet security, remembering that compliance is NOT synonymous with actual security.  Just because you may be in compliance with requirements for security measures, you may not have any real security in place.  Most organized crime hackers are ahead of companies.  These criminals target business and government, both of which are vulnerable to being hacked, especially since the criminals make hacking into business and government their priority.

 Second, all computer information needs to be closely monitored to keep the hackers from using employees (through emails, social networks, etc.) to access private information.

What to do? Some ways to protect your business are:

  • Improved security (internal and physical security: cloud servers, vendors, and the company’s own sites)
  • Planned defense measures in the event of a hack
  • Rapid detection  (SC’s delay in discovery and notification was detrimental)
  • Careful monitoring (of employees and systems)
  • A security provider (hiring one is a good idea for small companies)

Spending money on beefing up security is worth the expense.  Having someone onsite who is in charge is imperative for protection from hackers.

While nothing in cyberspace is foolproof, taking certain measures to improve company security can make a difference in the constant battle to protect secure, sensitive information from hackers.

Of course, Cyber Risk Insurance is a critical part of the equation to protecting the governmental entity or private business against cyber crime.

Source: Protect Data from Lurkers and Hackers COLUMBIABUSINESSMONTHLY.COM, December 2012.

1 vote, 5.00 avg. rating (90% score)
Categories: Breach Of Security, Cyber Liability, Identity Theft

Massive Hacking of SC Department of Revenue Database

A foreign hacker stole confidential S.C. tax records of 4.25 million individuals and businesses. Anyone who filed a state tax return since 1998 is subject to theft of all information contained on their tax returns including Social Security numbers, bank account numbers, and credit card numbers. Approximately 387,000 credit card numbers were stolen of which 16,000 were unencrypted.

The state of South Carolina has responded with the following plan of action:

All tax return data is now being encrypted and they are considering not holding tax data for such a long period of time.

SC taxpayers and their children who were victims of the data breach will receive a year of free credit monitoring and up to $2M in insurance and free lifetime credit fraud resolution through Experian. The cost of a lifetime fraud resolution through Experian is $12 million. The annual cost of credit monitoring to the state of S.C. is $8.00 a person, or $28.8 million if all 3.6 million taxpayers affected sign up for the service.

After the one year of free credit monitoring expires, taxpayers may be able to renew at a cost of $160 to $240 per year.

Credit monitoring will not prevent ID theft but will alert taxpayers sooner if ID theft has occurred. Credit monitoring will inform taxpayers of newly opened accounts, credit inquiries, and bill delinquencies at all three of the major credit reporting agencies: Experian, Equifax, and TransUnion.

An IT consulting firm, Mandiant, has been hired a cost of $125,000 to repair data-technology gaps and to install additional security measures.

The law firm, Nelson Mullins, has been hired to assess liability issues.

In the meantime, an attorney has filed a class action lawsuit on behalf of all affected taxpayers asking for $1000 per taxpayer alleging negligence in failure to timely notify taxpayers of the breach and in failing to secure the confidential data.

Apparently, like many states, the SC Department of revenue did not encrypt the confidential information. According to sources, the hacker “got into the conversation” on the communication system used by revenue department officers across the state and was able to obtain a user name and password. The data breach occurred in September but was not reported for some time as the department attempted to catch the crook and close the security breach.

Just another example of why business and governmental entities should carry Cyber Liability insurance.

Source: The State newspaper, Columbia, South Carolina, October 31 and November 3, 2012

1 vote, 5.00 avg. rating (90% score)
Categories: Breach Of Security, Crime, Cyber Liability

Is South Carolina Equipped For Cyber Attacks?

After dealing with the repercussions of war, earthquakes, and hurricanes, South Carolina now needs to ready themselves for cyber attacks; another possible catastrophe.

Senator Graham said: “Just imagine life in a city the size of Charleston where nobody’s cellphone works, where your computer shuts down and the power goes off. But unlike fixing a power line that is knocked down by a strong storm, there is someone out there intentionally causing this problem.”

Although cyber attacks are inevitable, U.S. Rep. Tim Scott thinks the Space & Naval Warfare Systems Command can assist with these cyber threats with the technology that is developed.

“Eighty-five percent of the cyber network is owned by the private sector,” Graham stated. “This is one area where the threat can only be dealt with in a partnership arrangement between the federal government, the state and local governments, and the private sector.”

Individuals must participate in the recovery of any catastrophe. Putting procedures in place such as using backup drives and keeping computer passwords and usernames in separate locations can assist in recovering from cyber attacks.

Source: Insurance Journal, July 19, 2012

1 vote, 4.00 avg. rating (80% score)
Categories: Breach Of Security, Cyber Liability, In The News

Pictograph Illustrates Cyber Risk

We came across an excellent pictograph that illustrates the risks involved in not protecting company information. Company reputation, customer satisfaction, and business opportunities are just a few examples of what is at risk due to cyber threats from failing to protect private data. Here is a brief outline of the information included in the pictograph:
… Read more →

3 votes, 4.00 avg. rating (80% score)
Categories: Breach Of Security, Cyber Liability, Risk Management, Tech Insurance

Reasons Cited For Not Purchasing Cyber Risk Insurance

Percentage of Businesses Citing Specific Reason

43%   Company self insures exposures
18%   Believe cyber risk covered under General Liability
17%   IT department does not think coverage is needed
16%   Coverage too expensive
  6%   Broker advised that risk of claim is low for the company
  5%   Company investigating the purchase of cyber risk insurance
  4%   Doesn’t know coverage exists
  9%   Other reason
11%   Not sure
… Read more →

2 votes, 4.00 avg. rating (80% score)
Categories: Breach Of Security, Cyber Liability, Risk Management

Cyber Insurance Policies Do Not Cover All Risks

To follow are examples of types of risks that are not covered or partially covered by most Cyber Risk policies:

  • The cost to implement security upgrades after an attack
  • A comprehensive written security program that is typically paired with a regulatory fine or penalty
  • Damage, corruption, or deletion of Intellectual Property
  • Audits performed periodically that are most likely required for several years after a data breach
  • Restoration of a damaged reputation of a business

For example, coverage under a Cyber Risk policy for the damage, corruption or deletion of Intellectual Property is typically limited to the cost of restoration or replacement, not taking into consideration the asset value of the stolen Intellectual Property to the company. In addition, most Cyber Risk Policies also will not provide coverage for upgrading security after an attack has occurred.
… Read more →

1 vote, 3.00 avg. rating (70% score)
Categories: Breach Of Security, Cyber Liability, Intellectual Property Infringement, Risk Management, Theft