[Breaches](/breaches) Police Procedural: How South Carolina Arrest Records Were Exposed [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Police Procedural: How South Carolina Arrest Records Were Exposed ##### [UpGuard Team](/team/upguard) Published Dec 11, 2019 ##### Join 27,000+ cybersecurity newsletter subscribers *Update: On the morning of 11 December 2019, Gizmodo published a story on Spartan Technology based on UpGuard's analysis. At 7pm EDT that night, Spartan Technology contacted Gizmodo to state that the data was for testing and the names had been "shuffled" to no longer correlate with their social security numbers and other data points. Both UpGuard and Gizmodo had been in contact with Spartan Technology prior to publication of their respective articles. Read more on *[*Gizmodo. *](https://gizmodo.com/arrest-data-exposed-by-south-carolina-firm-included-per-1840365182) The UpGuard Research team can now disclose that a cloud storage bucket containing [personally identifiable information (PII)](/blog/personally-identifiable-information-pii) for thousands of people in the South Carolina justice system has been secured. An employee of Spartan Technology, a South Carolina tech company, had uploaded a collection of backups to the AWS S3 storage service. The data collection included four MSSQL database backups, weighing in at around 14 gigabytes each, with information regarding 5.2 million arrest events, individuals charged with crimes, the alleged victims, and witnesses (if any). Only names and phone numbers were present for victims and witnesses. In a significant number of arrestee records, the database included full names, dates of birth, phone numbers, drivers license numbers, and approximately 17,000 unique social security numbers. **Fortunately, in what should be considered a successful **[**incident response**](/blog/incident-response-plan)**, the company involved responded quickly and responsibly to secure the **[**sensitive data**](/blog/sensitive-data)**.** ## Discovery and Response On November 19, 2019 an UpGuard researcher identified several files within the AWS S3 bucket as downloadable and soon after verified the files contained sensitive information about real individuals. The owner of the data was believed to be Spartan Technology from a combination of the name of the bucket, a company logo, and information in the database backups. Chris Vickery notified the company via email and phone about the [data leak](/blog/data-leak). That day the company responded to UpGuard's notification, identified the owner of the bucket, and removed public access. This kind of active and open engagement with a security researcher should be lauded, as it speeds up response time and ultimately reduces the risk to the individuals affected. ## Significance The most significant portions of the exposed data were a set of four files that combined to form one large database backup. After restoring the database from these files in an offline instance of Microsoft SQL, the total size was a little over 60 gigabytes, and the dates showed the records were generated from 2008 to 2018, when the backup was created. Spartan Technology was able to confirm that the database was part of a system used by district attorneys in South Carolina, which aligns with the types of data present. Many of the tables contained information which would be relevant to the administration of cases. One table had records for people charged with crimes and contained approximately five million rows. One column contained a property called "person id," and the count of unique numbers was over 26,000– the best hint for the number of unique arrestees. Given that this data was collected over a decade, it represents only a fraction of the total arrestees in South Carolina, but a sizeable portion nonetheless. Currently, [approximately 38,000 people are incarcerated in South Carolina](https://www.prisonpolicy.org/profiles/SC.html) and 74,000 are in the criminal justice system.  The table documenting events related to crime had over a hundred columns, many labeled with opaque acronyms, but among the more obvious fields corresponded to full name, home and mobile phone, date of birth, social security number, height and weight, race, and military or juvenile status. Analysts confirmed the existence of entries marked as being members of the military and juveniles. A second table contained 13 million rows due to the inclusion of non-defendant individuals (relevant officers, victims, and witnesses) in addition to defendant data (much of the same data for criminal defendants as in the table discussed above). As before, that does not represent the number of unique individuals involved– there were 26,000 unique “PersonID” numbers, each assigned to a defendant.  Taken together, the data set offered a view of the personal information of defendants, witnesses, and victims that was intended only for use by district attorneys as authorized representatives of the state. [Disparities in the criminal justice system ](https://www.prisonpolicy.org/profiles/SC.html)itself then trickled down to the those affected by data exposures. In South Carolina as a whole, twenty-two percent of the general population is Black compared to sixty-two percent of the jail and prison population. The data in this exposure tracked with that trend, with approximately seventy-five percent of the arrest events involving a person whose race was recorded as "B." ## Conclusion The UpGuard research has shown for years that [data leaks](/blog/data-leak) like this one are widespread problem that can affect organizations of every size in every industry. The ways in which data are exposed are in many ways similar– process errors and misconfigurations– but the ramifications vary by the kind of data particular to the sector. Individuals charged with crimes have no choice whether to consent to data collection requirements put on them by the state. The reliance on a digital supply chain for the administration of those cases then creates risk for that data to be inadvertently exposed. Given that this is a universal challenge facing all businesses, the capability that distinguishes those most deserving of their customers' trust is how they handle such incidents, and in that regard Spartan Technology's response was exemplary.  ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)