Follow Beinsure
Stolen Social Security numbers (SSNs) are being sold on dark web marketplaces for less than $2 each, according to new research by Coveron. The investigation identified thousands of listings offering personal information that criminals can use to open fraudulent accounts, obtain credit and impersonate victims.
The price of a compromised SSN is comparable to everyday purchases such as a loaf of bread or a dozen eggs. The potential financial consequences for victims, however, can persist for years.
- Researchers identified 5,885 dark web posts selling stolen Social Security numbers, with individual records priced below $2 and bulk purchases available for less than $1 each.
- Approximately 26% of 733 U.S.-linked databases analyzed contained exposed SSNs, with the MOVEit vulnerability exploited by the CL0P ransomware group accounting for much of the exposure.
- Victims face a median delay of 50 days between a data breach and public disclosure, giving criminals time to commit identity theft, financial fraud and benefits fraud before individuals receive notification.
Coveron examined dark web forums and private messaging channels to investigate how stolen SSNs are priced, distributed and exploited. Researchers identified 5,885 active posts offering data packages containing Social Security numbers over the past two years.
Individual records were advertised for up to $2, while buyers purchasing 100 or more records could obtain them for less than $1 each.
Most people think of identity theft as something that must require a sophisticated, targeted attack. The reality is far more mundane and alarming – your Social Security number can be sold in bulk, at a discount, like a commodity.
Tomas Sinicki, managing director at Coveron
He warned that criminals could use inexpensive stolen identity information to apply for financial products, submit fraudulent tax returns and damage victims’ credit histories.
How criminals use stolen Social Security numbers
Coveron’s analysis identified several forms of identity theft and financial fraud frequently discussed in dark web communities.
These include bypassing Know Your Customer (KYC) and identity verification procedures, applying for credit cards and loans, establishing bank accounts for fraudulent cash withdrawals, and submitting false tax refund claims.
Other reported uses include SIM porting fraud, unemployment and government benefits fraud, and the creation of synthetic identities using combinations of genuine and fabricated personal information.
A stolen Social Security number can generate proceeds for multiple criminals because the information can be reused and resold. One buyer may use an SSN to obtain a credit card, while another could purchase the same number to submit a fraudulent tax return.
“What makes SSN theft so insidious is that a single number keeps paying out for criminals, over and over again. They don’t use it once and move on: they sell or resell it, and each new buyer can find a way to monetize it,” Sinicki said.
Victims can consequently face debts they never incurred, tax returns submitted without their knowledge and accounts opened using their identities.
Unlike passwords, compromised Social Security numbers cannot simply be replaced. The Social Security Administration generally issues new numbers only in exceptional circumstances, including documented cases of persistent identity theft causing serious long-term harm.
Obtaining a replacement can take months, and the original number remains linked to the individual’s historical records across databases. This can create continuing administrative problems and require years of monitoring and corrective action.
One in four U.S. data breaches exposes Social Security numbers
Social Security numbers are widely used throughout the United States to establish identity in financial, employment, healthcare and government systems.
Individuals routinely provide their SSNs to employers, banks, hospitals and public agencies, creating multiple potential sources of exposure when organisations experience data breaches.
Coveron’s examination of 733 U.S.-linked databases available on the dark web found that 190 contained compromised Social Security numbers, equivalent to approximately 26%, or one in four.
A substantial share of the exposed information was associated with the MOVEit file transfer software vulnerability exploited by the CL0P ransomware group.
The research identified the MOVEit incident as the largest contributor to the increase in SSN exposure observed in the analyzed databases.
The findings demonstrate how a single vulnerability affecting software used by multiple organisations can result in extensive distribution of sensitive identity information.
Data breach victims face a median 50-day notification delay
The investigation also examined the period between a security breach and its public disclosure.
Although organisations are legally required to notify affected individuals under applicable data breach notification rules, those disclosures often occur well after the initial compromise.
Coveron’s analysis of publicly reported breach timelines found a median delay of 50 days between a breach and public disclosure. In some cases, the interval exceeded one year.
During that period, compromised Social Security numbers may already be circulating among criminals, while affected individuals remain unaware of the exposure.
The delay creates opportunities for identity theft, including fraudulent credit applications, tax refund claims and attempts to obtain government benefits.
“Fifty days is a long time to be exposed without knowing it. By the time you get notified, a criminal may have already opened three credit cards, filed your tax return, and sold your number to someone else,” Sinicki said.
He identified the period between the breach and victims becoming aware of it as a significant source of potential financial damage.
The combination of low prices, repeated resale and delayed notification means criminals may have considerable time to exploit stolen information before affected consumers can take protective measures.
How to protect Social Security numbers from identity theft
Coveron identified four protective measures that can reduce exposure to identity fraud and help consumers address the consequences of stolen Social Security numbers.
- Monitor personal information and respond to breaches. Individuals who discover that their information has been exposed should change compromised passwords and enable two-factor authentication as quickly as possible.
- Freeze credit reports when not applying for new accounts. A credit freeze can prevent criminals from opening many types of new credit accounts using stolen Social Security numbers and other personal details.
- Verify unexpected identity confirmation requests. Consumers should be cautious when contacted without warning by someone requesting personal information. Rather than providing details, they should contact the organisation directly using independently verified contact information.
- Consider identity theft protection services. Services offering monitoring and recovery assistance may help identify fraudulent activity and manage the administrative process following identity theft. Coveron recommends selecting providers that include identity theft insurance to help cover eligible financial losses and provide specialist recovery support.
Even when compromised information is detected quickly, resolving identity theft can require substantial time and administrative effort.
The research identifies delayed breach notifications as a particular concern because victims may have no indication that their Social Security numbers have been exposed until after fraudulent activity has occurred.
This research was conducted by Coveron and supported by data from NordLayer Intelligence by NordStellar. The research is based on three sources: a dark web analysis, a consumer survey, and public data breach listings. Coveron and NordLayer Intelligence analyzed dark web forums and private messaging channels for posts about buying and selling personal data packages that contain Social Security numbers. The research ran from June 2024 through June 2026, and the data was collected using the NordStellar platform.
