Who Stole 3.6M Tax Records from South Carolina?
Summary: KrebsOnSecurity reports that the 2012 breach of the South Carolina Department of Revenue, which exposed tax and bank account data for 3.6 million people, was likely carried out by the Russian crew behind the later Target and Home Depot card thefts. The breach began on Aug. 13, 2012, after a state IT contractor clicked a malicious link in an email, and on Oct. 7, 2012, a cybercriminal using the handle Rescator advertised a U.S. state tax database for sale on the Russian-language forum Embargo.
What you should know: South Carolina paid $12 million to Experian for identity theft protection and credit monitoring after the breach, and the IRS issued nearly $4 billion in bogus tax refunds in 2012 and more than $5.8 billion in 2013, largely to people filing fraudulent returns on stolen SSNs. KrebsOnSecurity's 10-year investigation identified Rescator as Mikhail Borisovich Shefel, a Moscow resident who has never been officially implicated in the South Carolina, Target or Home Depot breaches.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026