Worried Your Social Security Number Leaked? 'Don't Panic'

Reports suggesting the Social Security numbers of every American were leaked might be exaggerated, experts say. In April, a hacker using the name "USDoD" claimed to have accessed "the biggest database ever," allegedly containing 2.9 billion rows of data on the entire populations of the US, Canada, and the UK. The data include authentic names and Social Security numbers but also incorrect information. Troy Hunt of Have I Been Pwned found his email address in the data, but it was paired with the wrong name and two incorrect birthdates, per NBC News. "It's still unclear how much of the data is genuine and whether it all really came from hacking a company, as opposed to scraping publicly available sources," reports the Washington Post.

Rumors have swirled online since a class action lawsuit was filed Aug. 1, accusing background check company National Public Data of failing to safeguard personal data, including Social Security numbers. The plaintiff claimed an identity theft protection company informed him in July that his Social Security number was leaked in a National Public Data breach. But many Americans will have received a similar alert at some point, Amy Nofziger, director of victim support at the AARP, tells NBC. "My first piece of advice is don't panic, because most likely your information was already out there."

Nofziger recommends putting a fraud alert on your credit report, which "encourages or requires lenders and creditors to take extra steps to verify your identity," making it more difficult for bad actors to open accounts in your name, per NBC. Or you can take the further step of asking the three credit bureaus—Equifax, Experian, and TransUnion—to freeze your credit, blocking new accounts. You'll get a PIN you can use "to thaw the file when someone needs to examine it," the New York Times reports. But "don't lose the PIN or chaos can ensue." Otherwise, experts say to ensure accounts use long, unique passwords incorporating special characters and have two-factor authentication turned on, meaning you must confirm your identity via a text, phone call, email, or app to gain access. (More data breach stories.)