The Senate Finance Committee hearing on Tuesday afternoon began with SC Department of Revenue (DOR) Director Jim Etter reading a statement that was meant to soothe any fears that officials may have not handled the data breach properly.
But, by the end of the session, Sen. Harvey Peeler (R - Gaffney) said, "The questions outnumber the answers by about two to one."
The big revelation during the meeting was that, in addition to millions of individuals having their data exposed, so too have businesses. Etters did not know how many businesses were affected or to what degree. In fact, he only became aware that businesses were affected while he was testifying in the meeting.
The state had already agreed to provide credit monitoring for indidividuals with the credit rating agency Experian. It now appears it will have to provide those serivces to businesses as well.
The hearing in the Gressette Building became testy at times, as Etter was clearly uncomfortable when he was questioned by Sen. Larry Grooms (R - Berkleley) and John Matthews (D - Bamberg).
Grooms felt that the DOR had not been nearly proactive enough in helping the general public understand the depth of the data breach and was now asking the public to repair damage that could have been prevented. Grooms also wondered why officials went to Experian to handle credit monitoring services without shopping around for a better deal. The state eventually negotiated a deal with Experian that would cap the state's costs at $12 million.
Grooms also wanted to know why some agencies have its data encrypted while others, such as the DOR, do not.
Matthews began his questioning of Etter by saying, "The more I hear in this meeting, the more uncomfortable I become."
Many senators seemed to share Matthews' view, including chair Hugh Leatherman (R - Florence), who grew so exasperated with the lack of information that he turned much of the questioning over to his colleagues.
Phil Leventis (D - Sumter) wondered why the DOR hadn't reached out directly to those affected by the breach. When Etter said that privacy concerns limited the agency's ability to act, Leventis responded by saying, "Bullfeathers."
But most members were frustrated by the amount of time that passed from the time of the breach (Oct. 10) to the time is what made public (Oct. 26) and wanted to know why. They only grew more frustrated when Etter told them those questions could only be answered by law enforcement.
More announcements are expected in the coming days about the breach and what consumers can do to protect themselves.
To sign up for credit monitoring go to the website protectmyid.com/scdor and enter the code SCDOR123 or call 1-866-578-5422.