SCDCA Warns of Data Breach: What SC Residents Should Do

Breaches reported to SCDCA (first half 2026): 41 ·
South Carolina residents potentially impacted: 236,000+ ·
Total personal information exposed (first half 2026): 1.1 million ·
Companies involved in the warning: 3 (Prosper Marketplace, Kaplan North America, PowerSchool)

Five key figures from the SCDCA’s recent warnings, one pattern: each breach involved a different type of company but all exposed similar sensitive data.

What is the SCDCA data breach warning?

In a series of public statements starting December 2025, the SCDCA alerted residents to three separate data breaches that collectively exposed the personal information of hundreds of thousands of South Carolinians. The breaches involved Prosper Marketplace (a peer‑to‑peer lending platform), Kaplan North America (an education company), and PowerSchool (a student information system provider). The SCDCA, which acts as the state’s consumer watchdog, said the breaches exposed names, Social Security numbers, financial account details, and in the case of PowerSchool, children’s personal data.

The warning was issued because state law requires businesses to notify affected residents – and the SCDCA – when a breach impacts more than 1,000 residents. SC Consumer Affairs (state regulator) maintains a public archive of all notices received since 2015.

Which companies were involved?

• Prosper Marketplace – loan applicant data breached in September 2025; SCDCA warned 236,000+ residents on December 28, 2025. (WLTX)
• Kaplan North America – second breach, though specific numbers have not been released separately.
• PowerSchool – breach announced January 2025; SCDCA followed up on January 13, 2026, with a special alert for parents to check children’s credit. (SC Consumer Affairs)

How many people were affected?

• At least 236,000 South Carolina residents were potentially impacted by the Prosper Marketplace breach. (WLTX)
• The total number across all three breaches is not yet public, but the SCDCA reported that 1.1 million residents were affected by security breaches in the first half of 2026. (SC Consumer Affairs)

Why did I get a data breach notification?

If you received a letter or email saying your information was exposed, it’s because the company that suffered the breach is legally obligated to tell you. South Carolina law (South Carolina Legislature) requires businesses that have suffered a breach of personal information to notify affected residents “without unreasonable delay.”

What triggers a breach notification?

• Unauthorized access to computerized data that compromises personal information – usually a combination of name plus Social Security number, driver’s license number, or financial account number. (SC Legislature)
• The company must also notify the SCDCA if the breach affects more than 1,000 residents – at that point the SCDCA may issue a public warning.

Who sends the notification?

• The breached company itself sends the notification – not the SCDCA.
• The SCDCA may also publish a security breach notice on its public page. (SC Consumer Affairs)
• Notifications typically specify what data was exposed and offer steps to protect yourself.

The implication: receiving a notification does not automatically mean you are a victim of identity theft – but it means the risk is real. Take it as a prompt to act.

How do I know if I’m part of a data breach?

Even if you didn’t get a notification, you may still be affected. Here’s how to check – and the SCDCA offers free tools to help.

Check with the breached company

• Start with the company that experienced the breach. Many set up dedicated websites or phone lines.
• For the Prosper Marketplace breach, affected loan applicants should have received direct notifications. If you believe you applied for a loan through Prosper, contact them directly.

Use online tools like Have I Been Pwned

• Have I Been Pwned (independent breach tracker) lets you check if your email address appears in known breaches.
• It’s free and covers thousands of breach databases.

Monitor your credit reports

• You’re entitled to one free credit report per year from each of the three major bureaus via AnnualCreditReport.com (official source) – or call (877) 322-8228. (SC Consumer Affairs)
• Look for accounts you didn’t open, hard inquiries you didn’t authorize, or changes to your personal information.

Set up fraud alerts

• A fraud alert requires a business to verify your identity before issuing credit. Contact any one of the three major bureaus: Equifax (800) 685-1111, Experian (888) 397-3742, or TransUnion (888) 909-8872. (SC Consumer Affairs)
• The alert lasts one year and can be renewed.

The pattern: monitoring alone won’t prevent fraud – only a freeze blocks new accounts entirely.

How much compensation will I get for a data breach?

Compensation is not automatic, and most breach victims receive nothing unless a class‑action settlement is reached. The amount depends on the strength of the case, the number of claimants, and whether you can prove actual damages.

What factors determine compensation?

• Documented losses – fraudulent charges, legal fees, credit repair costs.
• Time spent – some settlements pay for hours you spent dealing with the breach.
• State laws – South Carolina allows consumers to sue for damages, but proving harm is often difficult.

Are there class action settlements?

• Yes – many large breaches result in class actions that offer credit monitoring or small cash payments. The Prosper Marketplace breach may lead to a settlement, but as of July 2026, details have not been finalized.
• Past settlements have ranged from $15 to $500 per claimant, but most offer two years of credit monitoring services instead of cash.

What is the Prosper data breach settlement?

• No official settlement has been announced yet. If you received a notice from Prosper, keep an eye on the case website. Compensation is not guaranteed.

The trade-off: even if you receive credit monitoring, it only alerts you after fraud occurs. The proactive step – freezing your credit – costs nothing and blocks new accounts entirely.

What happens if you have a data breach?

If your data was exposed, take these steps immediately. The SCDCA recommends acting within days, not weeks. (SC Consumer Affairs)

Immediate steps to take

1. Change passwords on all your online accounts – especially those tied to financial services.
2. Enable multi‑factor authentication wherever possible (email, bank, social media).
3. Monitor bank and credit card statements for any unauthorized charges. Report suspicious activity to your bank immediately.

Should you freeze your credit?

1. Yes, and it’s free in South Carolina. State law prohibits consumer reporting agencies from charging a fee for placing, removing, temporarily lifting, or reinstating a security freeze. (SC Legislature)
2. The freeze will stop anyone from opening new accounts using your information until you lift it. It does not affect existing accounts or credit checks by current lenders.
3. To request a freeze, contact each bureau: Equifax (800) 685-1111, Experian (888) 397-3742, TransUnion (888) 909-8872. Bureaus must place the freeze within five business days. (SC Legislature)

How to report a breach to SCDCA

1. Call the SCDCA Identity Theft Unit hotline: 800-922-1594.
2. Submit an ID Theft Intake Form online at consumer.sc.gov (SCDCA official portal).
3. Report identity theft to the Federal Trade Commission at IdentityTheft.gov.
4. If you have children, request a credit report for each child from all three bureaus. A report should not exist – if one does, it could be a sign of fraud. (SC Consumer Affairs)

Timeline of the SCDCA data breach warnings

Five key dates show how the situation unfolded.

The pattern: each warning escalated in scope, from a single company alert to a mid-year report covering the entire state’s breach landscape.

What’s confirmed and what’s still unclear

Confirmed facts

• SCDCA issued public warnings about three breaches (Prosper, Kaplan, PowerSchool).
• At least 236,000 South Carolina residents were potentially impacted.
• SCDCA received 41 breach reports in first half of 2026.
• Parents are advised to check children’s credit after PowerSchool breach.

What’s still unclear

• Exact number of individuals affected by each individual breach.
• Compensation amounts and settlement details.
• Long‑term impact on children’s credit from the PowerSchool breach.

The implication: without full accounting from each company, residents must assume their data may be at risk and act accordingly.

What South Carolina residents are saying – and what the experts recommend

“It is critical that consumers take immediate action to protect themselves. Freezing your credit is free in South Carolina, and it is the single most effective step you can take.”

– SCDCA spokesperson, July 2026

“The Prosper Marketplace breach may have exposed names, addresses, birth dates, and Social Security numbers of South Carolinians — that’s the kind of data criminals can use to open new accounts.”

– WLTX report

“Parents should request a credit report for each child from each of the three major credit bureaus. If a report exists, it could mean someone has already used your child’s information fraudulently.”

– SCDCA advice to parents, January 2026

The pattern is clear: South Carolina residents are not just targets of a single breach but of a wave of attacks on the vendors that hold their data. For the 1.1 million residents already affected in 2026, the choice is between a few minutes of inconvenience now – freezing credit, setting fraud alerts – and years of potential identity‑theft cleanup. For parents, the stakes are even higher: a child’s credit can be ruined before they turn 18, without any warning. The SCDCA has made the tools free and accessible. The only remaining question is whether residents will use them.

Residents can find more details in the SCDCA data breach warning from Signal Press, which outlines the same steps for protecting personal information.

Frequently asked questions