Is my Social Security number for sale?

Why your SSN being exposed is different from every other leak

Your email gets leaked, you can change it. Your phone number gets leaked, you can port it. Your password gets leaked, you can rotate it. Your Social Security number gets leaked, and you are stuck with it for the rest of your life.

The SSN was built in 1936 as an account identifier for the new federal old-age program. It was never supposed to be a password, a national ID, a credit-bureau primary key, or a default verification token. It became all of those by accident, over decades, because no other widely-shared identifier existed. Today, your SSN unlocks credit, government benefits, medical care, employment paperwork, and most identity-verification flows. None of those systems were designed for a world where the SSN is, effectively, public.

It is public. As of mid-2024, it was leaked.

The 2024 NPD breach: scale and bankruptcy

National Public Data, a Florida-based data broker, was breached in late 2023 or early 2024. The full corpus surfaced on a criminal hacking forum in August 2024. The leak included:

• An estimated 2.9 billion records, by the company's own court filings.
• Full names, current and previous addresses, phone numbers, dates of birth, family relationships.
• Social Security numbers attached to most records.
• Coverage spanning US adults, plus people in the UK and Canada whose data NPD had aggregated.

The corpus was being sold to anyone who paid in cryptocurrency on the forum. Soon after, copies were posted free. There is no putting that back.

NPD's parent company, Jerico Pictures, Inc., filed for Chapter 11 bankruptcy on October 1, 2024 in the Southern District of Florida. The filing cited "tens of thousands" of pending lawsuits, state attorney-general investigations, and an inability to fund the response. Bankruptcy doesn't make the leaked data un-leaked. It mainly means the people whose data was stolen are unlikely to see meaningful restitution.

Other SSN-exposing breaches worth knowing

NPD was the largest, but not the only one:

• Change Healthcare (2024). Cyberattack on the UnitedHealth-owned medical-claims clearinghouse exposed health and payment data for over 192 million Americans. SSNs were included in many records. Recovery and notification are still ongoing.
• AT&T (2024). Two separate breaches in 2024. The larger involved customer call records and account data; a related leak included SSNs for current and former wireless customers.
• Equifax (2017). The original credit-bureau breach exposed names, SSNs, birth dates, and addresses for 147 million Americans. Settlement payouts ran into 2024.
• Aggregated breach leaks. Known leak databases pool records from roughly a thousand publicly disclosed breaches into billions of compromised accounts. SSN coverage varies by breach.

If you have not been exposed in at least one major SSN leak, you are statistically unusual.

What you can do (and what you can't)

You cannot get a new SSN in most cases. The Social Security Administration grants new numbers only for documented ongoing harm — typically identity-theft cases that won't resolve, ongoing harassment, or witness protection. The application is paper-based, evidence-heavy, and denied more often than granted. The new number stays linked to the old one in SSA records anyway, so it is not a clean break.

What you can do:

1. Freeze your credit at all three bureaus. Free since 2018. Equifax, Experian, and TransUnion each need a separate freeze. This stops new credit accounts from being opened in your name. Lift temporarily when you legitimately need credit.
2. Get an IRS Identity Protection PIN. Free. Sign up at irs.gov/getanippin. The IRS rejects e-filed returns under your SSN that don't include the PIN. Single most effective defense against tax-refund fraud.
3. Monitor your Social Security earnings record. At ssa.gov. Anyone using your SSN for employment shows up as income you didn't earn. Catching this early matters because the SSA's correction process takes months.
4. Check your free credit reports. annualcreditreport.com. One per bureau per year, plus weekly free access continues post-pandemic.
5. Reduce the surrounding data. An exposed SSN is dangerous mostly when combined with your name, address, employer, family, and phone — the social-engineering scaffolding. Removing your data from broker sites cuts the scaffolding even when the SSN itself can't be retracted.

What identity-theft insurance does (and doesn't) do

The major credit bureaus offer paid monitoring with identity-theft "insurance" — typically $10 to $25 per month. The FTC has warned consumers that most identity-theft insurance covers recovery costs and lost wages, not the actual stolen funds. Banks generally reverse fraudulent charges under federal law anyway. The valuable part of most policies is the case-management service, not the coverage. Read the policy fine print.

The free defenses listed above — credit freezes, IRS PIN, exposure reduction — do more for your safety than any paid identity-theft insurance.

How Delist fits

Delist does not get your SSN back. Nobody can do that.

Delist does the thing that's actually achievable: cuts down the personal data attached to your SSN that makes attacks profitable. The broker sites that publish your name, address, phone, and family connections — the people-search sites that aggregate this data — each get a removal request. We catch re-listings and re-submit automatically.

An exposed SSN with no surrounding social-engineering data is harder to weaponize. That's the available win.

Frequently asked questions