In the previous article in this series on the collateral damage resulting from a data breach, we looked at the wide ranging damage that can be done when a Personally Identifiable Information (PII) is compromised. In this article, we will look at the collateral damage of a Social Security number data breach.
Social Security Numbers serve as a primary piece of PII – a 9-digit number that the Federal government issues to US citizens, permanent and temporary residents. Over the last 80 years, the Social Security Administration has issued more than 450 million original Social Security numbers (SSN). The ubiquity of the SSN has led to its universal adoption as a primary means of identifying an individual with whom a broad array of personal and confidential information may be associated.
While it is possible to have the Social Security Administration issue a new number, few exceptions are made. A US citizen has to experience ongoing disadvantages, due to a breach involving their social security number in order to have a replacement request approved.
Data Breaches Involving Social Security Numbers With Large Organizations
In September 2015, Experian discovered that hackers compromised T-Mobile data, housed on an Experian server. The bad actors infiltrated more than 15 million records were downloaded. Hackers stole records that included, along with other identifying information, included the names, addresses, and Social Security numbers of individuals who applied for T-Mobile services. Experian offered the T-Mobile victims, whose information was exposed, free credit monitoring from Experian for one year.
The 2017 Equifax data breach, discovered in July 2017, compromised the records of nearly 150 million consumers. Hackers made away with the names, phone numbers, birth dates, driver’s licenses and social security numbers. Equifax agreed to settle with $425 million devoted to helping individuals impacted by the data breach. The organization basically supported people with free credit monitoring and identity theft protection services, plus cash paid for expenses related to the theft.
In June 2019, Capital One suffered a data breach that compromised 100 million individuals in the US and 6 million people in Canada. Hackers stole credit scores, credit limits, balances, payment history and contact information. In addition, 140,000 Social Security numbers were involved in the breach. The cybercrime was an insider threat targeting Credit card application information that went as far back as 2005. The fallout continues to tarnish the Capital One reputation, as customers turn elsewhere for their personal finance needs.
Collateral Damage Examples of a SSN Data Breach
As we noticed, compromised entities may offer some kind of recompense, such as free credit reporting or some kind of meager payout. However, these kinds of offers do almost nothing for the more serious and less talked about potential consequences that the breach may have brought on for individuals, including:
- Identity Theft: Since a SSN is the universal “key” record to associate with a broad spectrum of separate data, it is the key to creating a nearly bulletproof false identity. Bad actors can use such a deep false identity to apply for a marriage or professional license, obtain a passport, establish a business, be declared dead, or essentially anything that has long-term recourse. The credit card report will not be impacted immediately.
- Being Associated With Criminal Activity: Stolen SSNs can be used to verbally provide identification information to law officers during a routine traffic stop or misdemeanor violation. The fraudulent person may receive a citation to appear in court, but of course would not attend the hearing. The inevitable result would be the court issuing a bench warrant for the individual legitimately associated with the stolen SSN. In other cases, with a Social Security number data breach, a fraudulent person could plead guilty for a misdemeanor, a felony, or DUI, resulting in a criminal record in the victim’s name that could most likely block the victim from obtaining a job, securing housing or obtaining credit.
- Obtain Medical Services: When you walk into the clinic or hospital for medical treatment one of the many pieces of data the facility will collect each time is your SSN. If the fraudulent person has additional information about you, his/her treatment and test results will make it onto your electronic medical history – which doctors and other practitioners depend upon to provide you with safe and responsive treatment. The results could be, well, life threatening.
- File Fraudulent Returns and Claims: With information from a Social Security number data breach, imposters can file fraudulent tax returns and insurance claims or apply for government benefits.
Social Security Data Breach Fallout Outweighs Organization’s Protective Measures
Providing a credit monitoring service to victims of Social Security number data breach is a nice gesture, but what happens if fraudulent credit activity happens before or after the organization provides credit service after the breach has occurred? It can take months, even years, to repair the damage and, unfortunately, it is all at an out-of-pocket expense to the victim. Damaged credit – even if fraud is later proven – may mean paying heavy deposits for utility services, high interest rates on loans and credit cards, and a reduction in your available credit limits (which will further lower your credit score). While a brief window of free credit monitoring may be appreciated, it doesn’t really begin to address the full scope of the damage that can be caused by a Social Security number data breach.
Threatmodeler Strengthens Your Protection From a Social Security Number Data Breach
Social Security numbers are considered vital pieces of PII and organizations must do everything in their power to protect the privacy of consumers who provide them. ThreatModeler is a powerful, automated platform that helps enterprises to better understand the security threats and vulnerabilities that can compromise an IT application infrastructure.
To learn more about how ThreatModeler™ can help your organization build a scalable threat modeling process, book a demo to speak to a ThreatModeler expert today.