Nearly half of all South Carolina residents were affected by a massive data breach at the credit-reporting company Equifax, marking the state’s biggest hacking incident in five years.
Equifax told state officials that some 2.4 million people in the Palmetto State had sensitive personal information compromised when its files were stolen, according to a letter sent to the S.C. Department of Consumer Affairs.
The disclosure highlights the massive scale of the breach, which included the names, birthdays, addresses and Social Security numbers of an estimated 143 million Americans. The company says some credit card numbers and driver’s license information were also stolen.
The cyberattack is one of the largest and most intrusive in recent memory. In South Carolina, records show it’s the largest breach since 2012, when an attack on the state Department of Revenue swept up information on 6 million taxpayers and their dependents.
Unlike most data breaches in the corporate world, no one signed up for Atlanta-based Equifax to gather their information. The firm is one of the three primary credit agencies, building dossiers of information that are widely used to evaluate people for loans, residential real estate leases and jobs.
The scope of the attack and the nature of Equifax’s work quickly drew the scorn of politicians and a series of investigations when the company announced the breach earlier this month. The company has also attracted scrutiny by promoting a credit-monitoring service it charges for.
Attorneys general from 34 states, including South Carolina, sent a letter to the company Monday asking it to stop offering the for-profit service. The prosecutors wrote that they were concerned it would confuse consumers, saying it was "unfair" to people scrambling to protect their identities.
"The people of South Carolina are angry about this breach and the potential for identity theft," South Carolina attorney general Alan Wilson said in a statement. "For Equifax to give the impression that it’s trying to make a profit off of its own breach makes them even angrier, and understandably so."
In a statement Monday, Equifax didn’t indicate whether it would heed that call, saying only that it cooperate with the prosecutors. The states say they’re investigating the breach and why the company waited to disclose it after discovering the issue in July.
"We appreciate their interest in working with Equifax to resolve the concerns of consumers impacted by the breach," the company said. "We have been in regular communications and are cooperating with the attorneys general and look forward to continuing to work with them."
The letter also called on Equifax to pay consumers back for the cost of freezing their credit reports. Equifax has waived the cost of locking the reports it produces, but the prosecutors asked the company to reimburse fees charged by its competitors, Experian and TransUnion.
In South Carolina, it’s already against the law for credit agencies to charge people for a credit freeze, according to the Department of Consumer Affairs.