Coveron’s research found 5,885 dark web listings selling stolen Social Security numbers, priced below $2 individually and under $1 in bulk. Approximately 26% of 733 analysed US databases on the dark web contained exposed SSNs. Victims face a median 50-day gap between a data breach and public notification. Unlike passwords, SSNs cannot be changed, meaning criminals can resell the same number repeatedly, with each buyer finding a new way to monetise it.
5,885 Listings. Under $2 Each.
The scale Coveron documented is harder to absorb than the price. Nearly 6,000 active posts, advertising SSN-containing packages at commodity prices. Buying a hundred records for under $100 total is simply a purchasing option on these platforms.
Tomas Sinicki, managing director at Coveron, put it directly: “Most people think of identity theft as something that must require a sophisticated, targeted attack. The reality is far more mundane and alarming , your Social Security number can be sold in bulk, at a discount, like a commodity.”
The research also found that roughly 26% of the 733 US-linked databases available on the dark web contained exposed Social Security numbers. One in four. That’s the baseline density of SSN exposure already sitting in criminal archives, before any new breach is added to the pile.
The single largest contributor to SSN exposure in the analysed databases was the MOVEit vulnerability exploited by the CL0P ransomware group. A flaw in widely used file transfer software resulted in a wave of breaches across hundreds of organisations simultaneously , the same supply chain attack pattern where compromising one shared tool cascades into exposure across dozens of companies and millions of individuals. MOVEit created SSN exposure at a scale no targeted individual attack could match.
What Criminals Do With a $2 SSN
The low price doesn’t mean limited usefulness. Coveron identified several distinct ways criminals monetise stolen Social Security numbers.
KYC and identity verification bypass. Financial institutions, lenders, and regulated services use identity checks to verify that a customer is who they claim to be. A stolen SSN combined with matching personal details can be used to impersonate someone through these checks. We’ve covered exactly this mechanism in depth looking at the synthetic identity fraud market , where criminals combine real SSNs with fabricated names and AI-generated documents to create entirely new fraudulent identities that pass automated screening.
Credit card and loan applications. An SSN and supporting personal details are typically enough to apply for credit in someone else’s name. Victims discover these accounts when collection notices arrive.
Tax refund fraud. The IRS processes refunds against the first return filed for a given SSN. Criminals who file first , using your SSN and fabricated income figures , claim the refund. You discover the fraud when your legitimate return is rejected.
Government benefits fraud. Unemployment claims, healthcare benefits, and other government programmes verify identity through SSNs. Stolen numbers can be used to claim benefits the real holder never receives.
SIM porting and account takeover. Mobile carriers use SSNs as part of identity verification for port requests. A stolen SSN helps criminals redirect someone’s phone number, which then enables bypassing SMS-based two-factor authentication on financial accounts.
The worst part, as Sinicki described it, is the compounding nature: “A single number keeps paying out for criminals, over and over again. They don’t use it once and move on: they sell or resell it, and each new buyer can find a way to monetise it.”
The 50-Day Gap That Hands Criminals a Head Start
Data breach notification laws exist specifically to give affected people time to protect themselves. The problem, according to Coveron’s analysis, is the gap between when a breach actually happens and when anyone tells you about it.
The median delay Coveron found was 50 days. In some cases, over a year.
“Fifty days is a long time to be exposed without knowing it,” Sinicki said. “By the time you get notified, a criminal may have already opened three credit cards, filed your tax return, and sold your number to someone else.”
This 50-day window is the period during which your SSN is actively in circulation and you have no idea. The credit card applications go out. The tax return fraud gets attempted. Your SSN gets resold to secondary buyers. You’re still thinking nothing unusual has happened.
The CenterPoint Energy breach illustrated the same gap from a different angle , the company didn’t discover that a hacker had been downloading data for days until the data appeared publicly on a dark web forum. The notification came after the exposure was already complete. That’s the structural reality: dark web listings often appear before victims or companies know anything has gone wrong.
Why You Can’t Just Get a New Number
Every other piece of identity-adjacent data can theoretically be replaced. Password: change it. Credit card: cancel it. Email address: create a new one.
Social Security numbers don’t work that way. The Social Security Administration issues replacement numbers only in exceptional circumstances , documented cases of ongoing, persistent identity theft causing serious long-term harm. The process takes months. And even if you do receive a new number, your original number remains attached to your historical records across tax databases, credit history, employment records, and government systems. Getting a replacement doesn’t erase the original. It just adds a second number to your profile while the compromised one remains connected to your history.
This is why Coveron and security researchers consistently describe SSN exposure as categorically different from other credential theft. The exposure has no straightforward technical remedy.
What You Can Actually Do
Coveron’s research identifies four protective measures. Here they are with the reasoning behind why each one works.
Freeze your credit at all three bureaus. Contact Equifax, Experian, and TransUnion separately. A credit freeze prevents new credit accounts from being opened using your SSN, regardless of what other information a criminal has about you. It’s free, doesn’t affect your existing credit, and you can lift it temporarily when you legitimately need to apply for credit.
Monitor your credit reports. Check all three reports at AnnualCreditReport.com — the official, federally mandated source. Look for accounts, addresses, or inquiries you don’t recognise.
Watch your tax account. The IRS allows you to create an identity protection PIN at irs.gov/identity-theft-central — a six-digit code that must be included with any tax return filed under your SSN. If someone tries to file a fraudulent return, they won’t have the PIN and it will be rejected.
Treat unexpected identity verification requests with suspicion. If someone contacts you claiming to be from a bank, government agency, or company and asks you to confirm your SSN, hang up and call that organisation directly using a number you find independently. Criminals using your real personal details to make impersonation calls more convincing is one of the most common downstream uses of stolen SSN packages, as seen in cases like the Flink triple extortion campaign where stolen data enabled targeted social engineering that was convincing precisely because attackers already knew real account details.
If you believe your SSN has already been used fraudulently, report it to the FTC at IdentityTheft.gov to get a personalised recovery plan and official affidavit documentation.
Frequently Asked Questions
What does a stolen SSN cost on the dark web?
Under $2 for a single record, under $1 each for bulk orders of 100 or more, according to Coveron’s two-year research.
How many SSN listings did Coveron find?
5,885 active posts on dark web forums and private channels offering data packages containing stolen Social Security numbers.
Can I get a new Social Security number if mine is stolen?
Only in exceptional circumstances. The SSA issues replacements rarely, the process takes months, and your original number remains connected to your historical records regardless.
What’s the biggest risk from a stolen SSN?
That it gets resold repeatedly , each new buyer finding a different way to use it. One criminal applies for credit. Another files a fraudulent tax return. A third uses it for benefits fraud. The same number pays out multiple times.
