Social Security Numbers Hacked: How to Avoid Identity Theft

A stolen database of sensitive personal information is for sale on the dark web

If your personal information—things like your credit card number, home address, or phone number—has been compromised in a security breach, that’s bad. If your Social Security number has been compromised, that’s potentially much worse.

This nightmare scenario came true for many Americans recently, when it was revealed that the data broker National Public Data, which sells people’s information to employers, staffing agencies, and others for use in background checks, had been victimized by a huge data breach back in December 2023.

A hacker group called USDoD reportedly stole 2.9 billion identity records of people in several countries, including millions of Americans. The breach involves names, home addresses, phone numbers, email addresses, names of relatives, and most worryingly, U.S. Social Security numbers. Some of this data has already been leaked on the dark web, where the group is apparently offering the entire stolen database for sale.

Having your Social Security number exposed or sold on the dark web can open the door to identity theft. Cybercriminals could use it to apply for loans, credit cards, and more in your name, potentially destroying your credit. They might also use your Social Security number in combination with other breached information to illegally access your existing banking or investment accounts, or commit any number of fraudulent acts while posing as you.

Major data breaches like the one at National Public Data are becoming increasingly common. Whether or not your Social Security number is part of this latest breach—National Public Data has not yet, as of this writing, sent out breach notification letters to victims—the time is now to start taking precautions against identity theft. Here are some protective steps.

Set up dark web scanning.

Use a proactive surveillance tool like CyberScan, available as part of the IDX Complete Plan, for continuous monitoring of all layers of the web—including the dark web where cybercriminals operate—to see if your Social Security number or any other personal data has been breached. If your information turns up, you’ll get an immediate notification; you can then take further steps like the ones below to help prevent identity fraud.

Carefully monitor your credit.

If you believe your Social Security number or other sensitive personal information has been breached, keep a close eye on your credit. Get a free credit report from the three credit reporting agencies (Equifax, Experian, and Transunion) by visiting AnnualCreditReport.com, a site authorized by federal law. Check the report particularly for any “hard inquiries” that you don’t recognize, in which a creditor has requested to view your credit file. If you see any inaccurate or unusual information, notify the credit reporting agency. (Note that 24/7 credit monitoring and free credit reports are included with IDX Complete Plan membership.)

Establish a credit freeze if necessary.

If you’re at high risk of identity fraud, consider placing a freeze on your credit. This can help prevent fraudsters from opening accounts in your name; it also stops lenders and other businesses from accessing your report. To set up this free service, you’ll have to contact each of the credit reporting agencies individually. You’ll also have to remember to contact them and lift the freeze whenever you apply for new credit or loans. (Alternatively, consider a credit lock. It also restricts access to your credit file, it’s quicker to set up, and it can be removed instantly at any time. While the reporting agencies typically charge fees for this service, the IDX Complete Plan includes Credit Lock by TransUnion® at no extra charge.)

Use multi-factor authentication.

If a fraudster attempts to access your existing accounts using your Social Security number and other personal data, you can help foil them by adding multi-factor authentication as an identity verification measure for your accounts. (Start by downloading an authenticator app like Google Authenticator, Microsoft Authenticator, Authy, or 2FAS.) This way, criminals can’t get into the account unless they also have physical possession of your unlocked phone.

Get an Identity Protection PIN.

If fraudsters have your Social Security number and other personal data, they might try to file a false tax return in your name. Consider getting a free Identity Protection PIN from the IRS. It helps the IRS verify your identity and it prevents others from filing a return using your information.

Recover your identity.

Finally, if you’ve become a victim of identity theft as a result of a data breach, take steps towards recovering your identity. You can go through the process on your own by visiting IdentityTheft.gov, a website established by the Federal Trade Commission (FTC) to aid in identity recovery. Alternatively, you can have a dedicated team doing the work for you. The IDX Complete Plan features a 100% identity recovery money-back guarantee and includes access to IDX’s expert care team, who will work with your financial institutions and the credit agencies to ensure your identity and reputation are restored.