HackingGovernmentGovernmentStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Financial accountMediumContained

South Carolina Department of Natural Resources

bd_c0c8462bcd969047 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 1, 2021

Filed

Jan 26, 2022

To disclose

25 weeks

Affected

1,243state residents only

Linked

2 filings

Confidence

64%

Full breach record for South Carolina Department of Natural Resources →

South Carolina Interactive, LLC notified the South Carolina DNR that a third-party call center service partner experienced unauthorized access to call recordings and screenshots between May 27 and August 16, 2021. The incident potentially impacted customer names and financial account numbers. The vendor relationship was terminated, and 24 months of Experian IdentityWorks were offered to affected individuals.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due25 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 66 days

discovery → filing · 25 weeks / 178 days

May 27, 2021

Begins

Aug 1, 2021

Discovered

Jan 26, 2022

Filed

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

New Hampshire State AGbd_8697f481f1fd46652022-01-21 · +5dVerified

Name: South Carolina, Interactive, LLC
norm: south carolina interactive

Name: South Carolina Department of Natural Resources
norm: south carolina department of natural resources
Industry: Governmentllm

Discovered: Aug 1, 2021
Breach occurred: May 27, 2021 – Aug 16, 2021
Undetected for: 66 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 22, 2022
Affected individuals: 1,243state-resident count only
Data types: Identity (basic)Financial account
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: This incident was reported to law enforcement
Initial access: trusted_relationship

During the incident: SCI and DNR had investigations undertaken to determine the nature and scope of the unauthorized access
The relationship with the call center company was terminated
Reviewing similar vendor contracts to ensure the appropriate controls are in place
Offering complimentary access to Experian IdentityWorks for 24 months
Changes made: The relationship with the call center company was terminated
Reviewing similar vendor contracts to ensure the appropriate controls are in place
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 25 weeks(178 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

New Hampshire State AGJan 21 · first

South Carolina State AG+5d · this page

Pattern: first filing Jan 21 (NH), last Jan 26 (SC) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/SC-DNR.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 26, 2022
Raw hash: 1cc78d96dd6f2fe47fba3b32e3df2e96be8622028aa5cfff16087a1ac758c65d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entitySouth Carolina, Interactive, LLC

Victim entitySouth Carolina Department of Natural Resources

Incidentdiscovered Aug 1, 2021

Stated responseSCI and DNR had investigations undertaken to determine the nature and scope of the unauthorized access

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov