Social security numbers leaked: what it means and what to do

Risk level: critical. Can you change it: no. Found in 7 breaches in this directory.

What this data is

The nine digit number the US Social Security Administration issues for work, tax and benefits, which lenders, employers, insurers and health providers use as the main key to your identity.

The risk on its own

An SSN is the closest thing the United States has to a master identity number, and it almost never changes. Lenders, tax systems, benefits agencies and employers all treat it as proof of who you are. Once it leaks, it stays useful to criminals for the rest of your life.

The risk combined with other data

With your name and date of birth, an SSN is enough to apply for credit cards, loans, phone contracts and apartments in your name. It also supports tax refund fraud, fake employment records and medical identity theft. Criminals blend real SSNs with invented details to create synthetic identities that build credit for months before cashing out.

How criminals use it

  • A fraudster files a tax return in your name early in the season and collects the refund before you file.
  • New credit cards and personal loans are opened with your SSN, name and date of birth, then maxed out.
  • Someone works under your SSN, so wages you never earned appear on your tax record.
  • Your SSN is combined with a different name and address to create a synthetic identity that lenders cannot trace to a real person.
  • A caller posing as the Social Security Administration says your number is suspended and demands payment to fix it.

What to do now

  1. Freeze your credit with Equifax, Experian and TransUnion. It is free, and it blocks most new credit applications in your name.
  2. Request an Identity Protection PIN from the IRS through your IRS online account, which stops anyone else filing a return with your SSN.
  3. Create a my Social Security account at ssa.gov before a criminal does, and check your earnings record for jobs you never had.
  4. Pull your free credit reports at annualcreditreport.com and dispute any account you did not open.
  5. Report identity theft at IdentityTheft.gov if you find fraud, which generates a recovery plan and official report.
  6. Hang up on anyone claiming your SSN is suspended. The SSA does not suspend numbers or demand payment by phone.

Frequently asked questions

Can I get a new Social Security number?

Only in narrow cases, usually where ongoing misuse is causing you harm and other steps have failed. Even then, old records stay linked, so a freeze and IRS PIN are the practical defence.

Does a credit freeze affect my credit score?

No. A freeze only stops new lenders reading your file. You can lift it temporarily when you apply for credit yourself.

Is identity theft insurance worth paying for?

The core protections, freezes, IRS PINs and credit reports, are free. Paid services mostly bundle monitoring and help lines you can decide on later.

Breaches that exposed this data

  • Unverified Data Source: 2021-01-26, 11M accounts, Bank account numbers, Credit status information, Dates of birth, Email addresses, Employers, Health insurance information
  • Dave: 2020-06-28, 3.0M accounts, Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses
  • Audi: 2019-08-14, 2.7M accounts, Dates of birth, Driver's licenses, Email addresses, Names, Phone numbers, Physical addresses
  • University of California: 2020-12-24, 547K accounts, Dates of birth, Education levels, Email addresses, Ethnicities, Genders, Job titles
  • GoldSilver: 2018-10-21, 243K accounts, Bank account numbers, Email addresses, IP addresses, Names, Partial credit card data, Passport numbers
  • DC Health Link: 2023-03-06, 48K accounts, Citizenship statuses, Dates of birth, Email addresses, Employers, Ethnicities, Genders
  • Vastaamo: 2019-03-31, 30K accounts, Email addresses, Names, Personal health data, Social security numbers

Tools that help

Related guides

Breach data sourced from Have I Been Pwned, used under CC BY 4.0. Additional breach metadata provided by XposedOrNot. DataExposed is an independent service and is not affiliated with or endorsed by either.