S.C. taxpayers at risk as cyber-thief swipes data

>> of the most damaging cyber thefts in u.s. history , a crime putting people at risk to have their identity stolen. michael isikoff has more on a shocking whodunit out of south carolina . michael, good morning to you.

>> reporter: savannah, good morning. south carolina governor nikki haley is releasing reports about how hackers broke into the state 's computer last month and stole millions of tack returns filed by state residents dating back more than a decade. it's caused a political uproar here, and as nbc has discovered, data like this is now being sold by cyber criminals on the internet black market . it may be one of the most alarming cyber crimes yet.

>> south carolina has come under attack by an international hacker.

>> reporter: governor nikki haley was angry.

>> i want that man brutalized.

>> reporter: the hacker infiltrated north carolina 's computer and stole data, 3.8 million social security numbers and 400,000 credit and debit card numbers, 650,000 business and tax returns . a former federal computer crime expert calls it a massive security breach .

>> for an identity thief , when you can get both social security numbers as well as all the other information on a tax return , that's a jackpot.

>> our actual bank and account and routing numbers .

>> reporter: tina and wade mather discovered $4,000 in fraudulent out-of- state charges to the same bank account they used to pay state taxes for their catering business.

>> we had to close out the business account. we had to close out credit cards . we had to close out debit cards . we had to basically shut down our entire financial situation

>> reporter: couple has now joined a class action lawsuit alleging state officials were negligent in protecting taxpayer data. you must have a lot of furious taxpayers in this state ?

>> and rightfully, so. you know, this is information that is private. even though you can't see this criminal, they are there, and they are waiting.

>> reporter: so what happens to this stolen personal data? nbc asked cyber sleuth debose to show us the black market . what he shows is a u.s. site offering u.s. credit card .

>> selling the data that's on the mag netflix strip from the back of the card which is a lot of personal information as well as the p.i.n. number.

>> operator michael browns has joined the chat.

>> reporter: this site offered 83 usa cred kards for $9 each and gave us fullz, full information, including social security numbers , and when we asked about credit cards from south carolina , and there was there. yes, i have south carolina , adding a smiley face and confirms he has fullz. now, governor haley has arranged for the state to spend up to $12 million to offer a full year of credit protection for residents and nearly 800,000 have signed up so far, but security experts say this attack has exposed more vulnerabilities in the country's cyber defenses. one big example, south carolina like many states had never encrypted those social security numbers found on the tax returns and now in the hands of the hackers. savannah.

>> really scary. michael isikoff , thank