COLUMBIA -- After delays, the state will start sending notifications today to 2.6 million South Carolinians whose personal information was stolen from the S.C. Revenue Department by hackers, the Governor's Office has announced.
About 1.2 million victims living out of state already are receiving written notices.
The notifications are coming two months after the state told the public about the breach and a month after Gov. Nikki Haley said investigators had identified whose information was stolen.
Waiting that long to send notices is "way beyond the pale," said Beth Givens, director of the Privacy Rights Clearinghouse in San Diego.
People who don't follow the news or lack online access need notification as soon as possible to know how to protect themselves, Givens said. Most notifications are sent within 30 days of when a data breach becomes public, she said. "A lot of damage could have been done in the meantime."
Since revealing the hacking on Oct. 26, Haley repeatedly has advised taxpayers to protect themselves -- including enrolling in a year of credit monitoring -- at no cost to the consumer -- from Experian, a firm that handles various aspects of consumer credit information. The state also has posted breach information on agency websites.
The state has extended by two months -- until March 31 -- the deadline for taxpayers and businesses to enroll in the credit monitoring service.
More than 950,000 people have enrolled, a number expected to swell once notifications are received.
While taxpayers don't have to pay the $160 to $240 annual fee for Experian's credit monitoring, the state is paying the firm $12 million. Experian has offered the state a second year of credit monitoring for $10 million. The Governor's Office has said it is considering that offer.
South Carolina is spending more than $20 million to repair damage from what's considered the country's largest-ever hacking of a state agency.
Hackers using computer logins taken from Revenue Department employees stole Social Security numbers, bank account information and other personal data belonging to 3.8 million taxpayers, including 1.9 million dependents and 700,000 businesses. Anyone who filed S.C. tax returns electronically since 1998 was affected.
The state is paying SourceLink Carolina of Greenville to send the notices, at a cost of $1.2 million, the Governor's Office said.
About 1.8 million taxpayers in South Carolina will get letters. More than 800,000 who signed up for credit-monitoring from Experian will get emails.
The notifications include information on how to enroll in credit monitoring and how to place a security freeze on credit reports. A freeze prevents the opening of new credit cards and loans.