During just the first three months of this year more than 550,000 South Carolina residents were exposed to data breaches at businesses and other organizations they had patronized.
They ranged from large financial and health care institutions to Chick-fil-A and a branch of Goodwill Industries. It’s a good reminder that a seemingly endless number of companies and nonprofits have lots of data about their customers and supporters, from credit card information to health care, and your passwords and personal information are in their hands.
If you’re among the more than 10 percent of Palmetto State residents whose data was compromised from January to March, you probably already know it. Breaches usually prompt letters to the victims, which typically come with an offer for free credit monitoring and a promise to do better.
The single largest breach during the first quarter, for South Carolina residents, involved TMX Finance. That’s the parent company of TitleMax, TitleBucks and InstaLoan.
“The personal information involved may have included your name, date of birth, passport number, driver’s license number, federal/state identification card number, tax identification number, social security number and/or financial account information, and other information such as phone number, address and email address,” TMX said in a March 30 letter to customers.
South Carolina residents unfortunately have become used to this. After hackers struck the S.C. Department of Revenue in 2012 with a simple phishing email scam and scooped up the income tax returns of 6.4 million residents and businesses — the state had 4.7 million residents at the time — one might have wondered what was left to steal.
But then came the Adobe hack in 2013 (38 million credit card numbers), Target in 2013 (41 million credit cards), and Equifax in 2017 (148 million credit reports and Social Security numbers).
Health care companies with data breaches that touched South Carolina residents in recent years include Community Health Systems, Genesis Health Care, Roper St. Francis, the state Department of Health and Human Services and Conway Medical Center.
If someone gets ahold of your credit card information, that’s usually not a big deal. Fraudulent charges don’t fall to the credit card holder, as long as they are discovered promptly, and the issuer will just cancel the hacked card and mail out a new one. This has already happened to me twice this year.
A larger danger is identity theft, where hacked personal information can be used to open financial accounts or even file tax returns in the victim’s name for the scammer’s benefit. It’s unfortunate that consumers must be extra vigilant because companies keep losing control of personal data, but that’s where we are.
So, assume your personal data is already for sale on the dark web, and take these steps:
- Review credit card and bank statements at least monthly for anything suspicious. The longer a problem goes undetected the longer it takes to repair.
- Consider putting a fraud alert on your credit reports, which requires businesses to take extra steps to make sure the person applying for credit is actually you. Contact one of the big three credit agencies (Equifax, Experian and TransUnion) to do this.
- If you have no plans to apply for credit, a security freeze is the strongest option. Put a security freeze on your credit at all three credit agencies and it remains in place until you lift it. Remember, though, that new utility accounts, or new landlords, often require credit checks.
Tips from the South Carolina Department of Consumer Affairs.
Data breaches can happen at any company or organization, but they also hit individuals, so remain vigilant about personal data. Always be suspicious of links in emails, and don’t respond to calls and texts seeking personal information.