What To Do If Your SSN Was Found on the Dark Web

How Dangerous Is It If Your SSN Is Found on the Dark Web?

A leaked Social Security number (SSN) almost guarantees that scammers will target you with identity theft at some point. A 2025 fraud study found that 97% of people whose SSNs were leaked to the dark web were victims of attempted identity theft. Even worse, after becoming targets, most victims faced more than 10 separate fraud attempts, on average, over a three-year period.

If you receive a data breach notice or dark web alert stating that your Social Security number (SSN) has been found on the dark web, immediately freeze your credit with all three bureaus and lock down your most sensitive accounts. 

If your SSN was leaked, you likely cannot cancel it and get a new one. While this is a worrying situation to be in, the good news is that you have more control over the outcome than you might think. 

How Did Your SSN End Up on the Dark Web?

In almost every case, an SSN ends up on the dark web due to a company or service’s data breach — not something you did wrong. 

Hackers break into a business's database (such as a retailer, healthcare provider, credit bureau, or government agency) and steal customer records, including SSNs. That data then gets sold or dumped onto dark web marketplaces.

SSN-related breaches have nearly doubled since 2021 — from 1,146 to 2,236 last year alone (comprising two-thirds of all reported data breaches). 

In an example from July 2025, cybercriminals that were linked to the extortion group ShinyHunters breached a third-party app used by the credit reporting agency TransUnion. The breach included the names, dates of birth, and unredacted SSNs of more than 4.4 million victims. 

Other, less common ways that your SSN can end up on the dark web include phishing attacks and fake websites, mail or sensitive document theft, and data brokers that collect and sell your personal information. 

One important caveat: Your risk depends on what other information was leaked alongside your SSN. An SSN by itself that’s sitting in an old, recombined data dump provides a much lower-grade risk than an SSN paired with your name, date of birth, and address leaked in a fresh breach. This combination is enough for a scammer to open credit, file a tax return, and pass identity checks in your name.

The Exact Steps To Take If Your SSN Was Found on the Dark Web

Even if you haven’t been targeted by identity thieves or hackers, a leaked SSN needs to be dealt with quickly. Lock down your sensitive accounts today to remove the most serious threats, and then work through reporting, initiating preventative security measures, and setting up ongoing monitoring. 

Here’s a detailed list of steps to take in order of importance:

1. Freeze your credit with all three major bureaus

Fraudsters can use your leaked SSN (along with other personal information) to take out loans or open new financial accounts in your name. 

A credit freeze blocks anyone (including you, until you lift the freeze) from opening new credit in your name. It's free, doesn’t impact your credit score, and is the single strongest means of protection against SSN-based fraud. 

To place a credit freeze, you’ll need to contact each bureau separately:

A fraud alert is faster to set up (one bureau notifies the other two automatically) but only requests that lenders verify your identity before extending credit. It doesn't block access the way a freeze does.

2. Lock your SIM card and phone account 

A leaked SSN is often bundled with your phone number. Scammers can use this stolen personal information to convince your carrier to port your number to a SIM that they control — allowing them to intercept your calls, texts, and two-factor authentication (2FA) codes. 

In one recent case, a Florida woman lost $17,000 in a matter of hours after a SIM swap gave scammers access to her bank account.

You can call your carrier to add a PIN or port freeze to your account. 

3. Change sensitive account passwords, and turn on 2FA 

Secure all high-risk accounts by using strong passwords and two-factor authentication (2FA) for email, banking, and any other accounts that could expose your financial information. 

• Use a unique password for every account. Don’t reuse passwords, as this can cause multiple accounts to become compromised if a single password is breached.  
• Store your passwords in a secure password manager. These tools serve multiple purposes by generating, storing, and easily accessing complex passwords, monitoring credentials across data breaches, and (in some cases) securing sensitive documents, such as photos of your ID or Social Security card. 
• Use an authenticator app for multi-factor authentication. If scammers take control of your phone number, they can intercept 2FA codes sent via text message. Apps like Authy or Okta prevent this by sending codes through a secure app instead. 

4. Submit an official identity theft report to the FTC

The Federal Trade Commission (FTC) provides an online portal for reporting identity theft incidents — including leaked SSNs and sensitive information — at IdentityTheft.gov. 

Victims receive a personalized recovery plan and an official identity theft affidavit that they can use to dispute fraudulent accounts with creditors and banks (or submit alongside a police report). 

If the paperwork and follow-up calls seem like a lot to manage alone, Aura’s robust identity theft protection includes access to Expert Fraud Remediation Specialists who hold Certified Identity Protection Advisor (CIPA)® certifications. 

5. Get an Identity Protection PIN (IP PIN) 

An IP PIN is a security tool offered by the Internal Revenue Service (IRS) that prevents anyone from filing a fraudulent tax return by using your SSN unless they also have a unique, six-digit code. The code is changed each year to help prevent tax fraud. 

Request an IP PIN through your IRS.gov account, even if you haven't had a tax problem yet.

6. Self-lock your SSN through the SSA E-Verify service 

The Social Security Administration’s (SSA) myE-Verify Self Lock tool blocks employers from using your SSN to verify a new hire, closing off employment fraud. It’s important to note that this only covers employment-related misuse and cannot protect against credit or tax fraud.

7. Review your credit reports and bank statements 

Pull free credit reports from all three major credit bureaus at AnnualCreditReport.com and look for accounts or hard inquiries that you don't recognize. Incorrect information on your credit reports can signal fraud or be a sign of synthetic identity fraud, in which scammers blend your real SSN with fake details to build a new credit profile.

Check your bank and credit card statements for unfamiliar transactions or withdrawals. 

Can you monitor your credit on your own? Yes, but it takes time and is an ongoing process. For most people who have had their SSN leaked, a credit monitoring service that continually monitors their credit files and sends notifications of changes and signs of fraud is an incredibly valuable tool. 

8. Request your Explanation of Benefits (EOB)

Medical identity theft happens when someone uses your SSN to receive care or drugs in your name. Your health insurer should be able to provide you with an EOB, which you can check against recent treatments for discrepancies. 

For help reading your EOB, follow the official resource from the Centers for Medicare & Medicaid Services.

9. Sign up for ongoing identity and credit monitoring 

Once your SSN is leaked to the dark web, it becomes a matter of when, not if scammers will use it against you. The threat could come tomorrow or in two years when your defenses are down. 

Identity theft protection services monitor your most sensitive information and accounts for signs of fraud, and provide support and insurance to help you shut down scammers quickly. 

For example, Aura combines identity and SSN monitoring with three-bureau credit monitoring, a full suite of device security tools, plus 24/7 U.S.-based support and up to $5 million in identity theft insurance coverage.

Can You Remove Your SSN From the Dark Web?

No. Once your SSN is posted to a dark web marketplace, it's typically copied, resold, and re-uploaded across multiple sites. Even if one listing gets taken down, backups usually resurface elsewhere. There's no service, including Aura's, that can delete data that's already circulating on the dark web.

It is unlikely that you can change your SSN. The SSA will only provide a new SSN in extreme cases, such as ongoing fraud that credit freezes and fraud alerts haven’t stopped, or a personal safety risk such as domestic violence. A new SSN can also complicate your credit and earnings history and even delay some government benefits. 

The bottom line: Don’t waste time or money trying to remove or change your SSN. Put that effort into securing your accounts, monitoring for misuse, and protecting your devices and accounts against hackers.

How To Check Your Full Dark Web Exposure

If your SSN has been leaked, it’s almost certain that more of your personally identifiable information (PII) is available on the dark web. There are three main ways you can check your full dark web data exposure: 

1. Run a free dark web scan. Tools such as Aura’s free dark web scanner or HaveIBeenPwned check your email against a database of known data breaches to let you know if your information was found. Note: these tools are limited to email addresses only and can’t search for more sensitive information, such as your SSN. 
2. Check for data breach notifications. State and federal laws require that companies disclose data leaks, along with what information was exposed. Check your mail and email for data breach alerts from companies and services that you use. 
3. Sign up for a 24/7 dark web monitoring service. Free scanners only provide a limited snapshot of your data exposure. They can’t warn you if your SSN turns up in a breach next month. Aura’s all-in-one solution provides the most extensive dark web monitoring — covering over 260 unique pieces of personal information, including your SSN, financial accounts, passwords, medical IDs, and home and auto title records — when compared to other leading identity theft protection providers. 

What you need to know: a one-time scan tells you about today. Ongoing monitoring tells you about tomorrow, which is vital because fraud from a dark web exposure can continue surfacing for years.

How To Keep Your SSN and Sensitive Data Off the Dark Web

Prevention is your main source of protection when it comes to dark web data leaks. The less of your sensitive information that you trust with companies, the lower the chances are that you’ll be swept up in a massive data breach. 

Here are some best practices to follow for online privacy: 

• Be selective when giving out your SSN. Ensure that any company that requests your SSN truly needs it and has proper data-handling and protection policies in place. 
• Use guest accounts when shopping online. Avoid saving your financial details with online retailers that could be hacked. 
• Provide false information for minor online accounts. Basic service providers don’t need your real address or phone number — and “poisoning” your data in this way can help prevent hackers from connecting together data from multiple leaks.
• Use a virtual private network (VPN). A VPN encrypts your browsing data so internet service providers (ISPs) and hackers can’t spy on you. VPNs are especially important when using public or untrusted Wi-Fi networks. 
• Protect your device with antivirus software. According to the ITRC, unauthorized device access is the primary threat for adults aged 35 to 64. Antivirus software can help block or remove malware that gives hackers access to your device and sensitive files. 
• Claim your my Social Security account by visiting SSA.gov. This prevents anyone else from opening one in your name and changing your details. You can also use it to check your earnings against your W-2 and spot employment fraud. 
• Keep your Social Security card in a secure location. Don’t carry your card with you. Shred any documents that contain your SSN once you no longer need them. 

The Bottom Line: An SSN Leak Is a Serious Risk — But You Have Options

While you might not be able to control whether or not your SSN gets leaked, you can control how (and how quickly) you respond to a serious breach. 

As soon as you receive a dark web alert, freeze your credit, secure your sensitive accounts, and set up the appropriate security measures to prevent misuse. Unfortunately, this isn’t a one-and-done exercise. Your SSN could be used at any time, which requires constant monitoring and vigilance. 

If you'd rather not manage all of this manually, Aura bundles three-bureau credit monitoring, dark web monitoring, generous identity theft insurance coverage, and 24/7 U.S.-based fraud support all into a single plan, with a 14-day free trial and a 60-day money-back guarantee on annual plans.