SCDCA Warns of Data Breach: What SC Residents Need to Know

A stack of mail can be unnerving these days, especially when one envelope carries a data breach notification. The South Carolina Department of Consumer Affairs (SCDCA) recently urged residents to stay vigilant after three separate breaches at Prosper Marketplace, Kaplan North America, and PowerSchool exposed personal data of more than 236,000 people (DeXpose). This article breaks down what happened, how to check if you’re affected, and the concrete steps you need to take now.

Affected residents: More than 236,000 · Breaches covered: 3 (Prosper Marketplace, Kaplan North America, PowerSchool) · Warning issued by: South Carolina Department of Consumer Affairs (SCDCA) · Warning date: April 2026 · State affected: South Carolina

Five key facts at a glance, each drawn from official state data and breach reports.

How much compensation will I get for a data breach?

Compensation amounts are not set by the SCDCA. They typically depend on actual financial losses, such as unauthorized charges or identity theft damages (DeXpose). Class-action settlements, when they occur, often distribute small amounts per claimant—sometimes just a few dollars or a year of credit monitoring (SC Department of Consumer Affairs).

What factors determine compensation?

• Proof of out-of-pocket expenses (e.g., fraudulent charges, credit freeze costs).
• Evidence of time spent resolving issues (some states recognize lost time).
• Whether the breach led to identity theft that harmed your credit (South Carolina Public Radio).

Do I need to prove financial loss?

In many cases, yes. Without a documented loss, compensation is less likely. However, some class-action suits include a “damages” fund that distributes without proof of loss (DeXpose). SCDCA does not administer compensation; affected residents may need to consult a private attorney (SC Department of Consumer Affairs).

Can I join a class-action lawsuit?

Yes, if one is filed. Check the breach notification letter for information about class-action rights. You may be automatically included or need to opt in (DeXpose).

How do I know if I have been affected by a data breach?

You may receive a notification letter in the mail or via email from the breached company. The notification typically lists what data was compromised (SC Department of Consumer Affairs).

What information is typically exposed?

• Names, addresses, phone numbers.
• Social Security numbers, driver’s license numbers.
• Financial account numbers, credit card numbers (DeXpose).

How do I check official breach notifications?

Look for letters from Prosper Marketplace, Kaplan North America, or PowerSchool. If you’re unsure, contact the company directly (DeXpose). SCDCA also publishes breach alerts on its website (SC Department of Consumer Affairs).

What should I look for in my credit report?

Check for unfamiliar accounts or inquiries. You can get a free report weekly at AnnualCreditReport.com (SC Department of Consumer Affairs).

Why did I get a data breach notification?

State law requires companies to notify affected residents when a breach involves personal information (SC State Library). South Carolina Code §39-1-90 mandates this notice within a reasonable time after discovery.

What laws require companies to notify?

South Carolina’s data breach notification law (SC Code §39-1-90) and federal laws like HIPAA for health data and GLBA for financial data trigger notification obligations (SC State Library).

Why might a notification arrive months after the breach?

Companies need time to investigate, determine which data was taken, and locate affected individuals. Notification logistics also take time (SC Department of Consumer Affairs).

What does the notification letter include?

The letter describes what data was breached, what the company is doing (e.g., offering credit monitoring), and steps you should take (DeXpose).

What to do if you receive a data breach notification letter?

Take these steps immediately, recommended by the SCDCA (SC Department of Consumer Affairs).

• Change passwords for affected accounts. Use unique, 16+ character passwords with mixed-case letters, numbers, and symbols.
• Turn on multi-factor authentication wherever available.
• Enroll in free credit monitoring offered by the breached company. Prosper and Kaplan offer Experian IdentityWorks for 2 years (DeXpose).
• Place a fraud alert or security freeze on your credit file with all three major bureaus: Equifax (Equifax), Experian (Experian), TransUnion (TransUnion).
• Monitor your credit reports for free at AnnualCreditReport.com (SC Department of Consumer Affairs).
• Be alert for phishing scams. Do not click links in unsolicited emails claiming to be about the breach.
• Report suspected identity theft to the SCDCA Identity Theft Unit at 800-922-1594 (SC Department of Consumer Affairs).

Can you go to jail for a data breach?

Individuals who intentionally hack or steal data can face imprisonment under federal laws (e.g., Computer Fraud and Abuse Act) and state laws. Companies typically face fines, not jail, unless criminal negligence is proven (DeXpose).

What are the criminal penalties for data breaches?

Under federal law, penalties can include up to 10–20 years in prison for aggravated identity theft. State penalties vary but can include fines and jail time (SC Department of Consumer Affairs).

Are companies or individuals held responsible?

Individuals who perpetrate breaches are criminally liable. Companies may face class-action lawsuits and regulatory fines, but criminal charges against executives are rare unless there is intentional misconduct (South Carolina Public Radio).

What is the difference between GDPR and US penalties?

GDPR imposes fines up to €20 million or 4% of global turnover, while US penalties vary by state. South Carolina does not have a specific statutory fine for data breaches; enforcement is through civil suits and regulatory actions (SC State Library).

“We urge all South Carolina residents to take immediate action to protect their personal information after these breaches.”

— SCDCA official statement (SC Department of Consumer Affairs)

“Parents should check their children’s credit reports because children’s data is often targeted and can go unnoticed for years.”

— ABC News 4 quoting SCDCA (South Carolina Public Radio)

The broader landscape shows a decline: in 2025, 99 breaches affected 2,985,506 South Carolina residents, a 56% decrease from 2024’s 121 breaches impacting 6,710,824 people (SC Department of Consumer Affairs). Still, thousands of residents now face the aftermath of these three incidents. The implication: while aggregate numbers are improving, individual vigilance remains the last line of defense.

Frequently asked questions