TechReview
Cybersecurity

SSN Stolen: What to Do When Your Social Security Number Is Compromised

Published By Shivam Sharma7 min read
Padlock and shield over a Social Security card with digital lock icons, cybersecurity illustration

A Pentagon notification letter dated September 18 discloses a breach affecting 2.76 million living individuals plus about 294,000 deceased individuals. Their Social Security numbers had been sitting in unencrypted files that unauthorized users could reach for roughly nine months, from October 2025 into July 2026. Officials have not published a breakdown of which groups make up the 2.76 million. The Pentagon says it has no indication the data was misused. That is not the same as proof it was never copied, and the identities of whoever accessed the files are still unknown. (Reported by TechCrunch and Fox News, citing Pentagon officials.)

Your SSN did not have to be in that breach for this guide to matter. It is the one number that unlocks tax returns, jobs, and credit in your name, and unlike a password you cannot just change it and move on. What follows is drawn from official FTC and IRS guidance: what to do today, what to do this week, and which steps people skip that cost them later. For the broader playbook covering any breached personal data, see our data breach guide.

The short version

Today:

  • Freeze your credit at all three bureaus: Equifax, Experian, TransUnion. Free, takes minutes, and does not touch your credit score.
  • File a report at IdentityTheft.gov. You get an FTC Identity Theft Report and a personal recovery plan.
  • Get an IRS Identity Protection PIN so nobody can e-file a tax return with your SSN.

This week:

  • Pull your free weekly credit reports at AnnualCreditReport.com and flag anything you do not recognize.
  • Check your Social Security earnings record at ssa.gov/myaccount for employers you never worked for.
  • Lock your SSN for employment purposes through E-Verify’s Self Lock (free myE-Verify account), which only blocks misuse at employers that actually use E-Verify.
  • File a police report if you find actual fraud. Bring your FTC report, a photo ID, and proof of address.
  • Watch for tax fraud, benefits fraud, and targeted scams quoting your SSN.

1. Start at IdentityTheft.gov

For a stolen SSN, your first stop is IdentityTheft.gov, not the SSA. The SSA cannot fix your credit record and refers identity theft complaints to the FTC. The one exception: if someone is using your number for work purposes, report that to the SSA directly — its own guidance says to contact them so they can review your earnings record with you.

Tell the site what happened. It generates your FTC Identity Theft Report and builds a personal recovery plan from your answers. That report is your proof to banks and lenders that the theft happened, and it gives you legal rights, including forcing credit bureaus to block fraudulent accounts from your file. Create an account so the plan updates as you go. If you skip the account, print everything before you leave the page. The FTC is explicit: once you leave, you cannot get it back.

2. Freeze your credit at all three bureaus

A freeze is the highest-leverage move on this list, and that is our judgment, not the FTC’s. It locks your credit file so no new account gets opened in your name while the freeze holds. Know its limits: a freeze only stops new accounts. It does nothing about fraud on accounts you already have, tax-refund fraud, or benefits fraud. Freezes are free to place and lift under federal law, and do not affect your credit score.

You must place it separately with each bureau: Equifax, Experian, and TransUnion. The FTC’s guide to freezes and fraud alerts links each bureau’s freeze page. When you legitimately need credit, lift the freeze temporarily and refreeze after. By law, the bureaus must process a lift request within one hour when made online or by phone; requests by mail can take up to three business days.

3. Fraud alert vs. freeze: know the difference

People mix these up constantly. A freeze locks the file shut. A fraud alert only tells lenders to verify your identity before issuing new credit.

  • Initial fraud alert: free, lasts one year, for anyone who suspects fraud. Contact one bureau and it must notify the other two.
  • Extended fraud alert: free, lasts seven years, but only for confirmed victims with an FTC Identity Theft Report or a police report. It also pulls you off prescreened credit and insurance offer lists for five years.

You can run a freeze and an alert at the same time. If your SSN is confirmed stolen, place the freeze first, then stack the extended alert on top once your FTC report exists.

4. Get an IRS Identity Protection PIN

Tax fraud is where a stolen SSN pays off fastest: file a fake return early in tax season, collect someone else’s refund. The IRS’s counter is the IP PIN, a six-digit number known only to you and the IRS. Without it, an electronically filed return using your SSN gets rejected.

Anyone with an SSN or ITIN who can verify their identity can enroll, even if you are not required to file a return. Parents and legal guardians can also get one for dependents. The fastest route is your online IRS account, where the PIN is viewable from mid-January through mid-November. A new one is generated every year.

One catch for dependents under 18: they cannot enroll through an online IRS account. For them, submit Form 15227 or book an in-person appointment at a Taxpayer Assistance Center.

Two warnings from the IRS: share the PIN only with your tax preparer when you file, and know the IRS never calls, emails, or texts asking for it. Anyone who does is running a scam. Details: irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin.

5. About getting a “new” Social Security number

Short version: almost certainly not happening. The SSA generally will not issue a new number without evidence that someone is actively misusing yours. And even when it does, a new number does not wipe the slate clean. The SSA’s own warning: companies and government agencies keep records linking you to the old number, so the thief’s trail follows you anyway.

The exception is narrow. Victims of family violence, harassment, abuse, or life-endangering situations can qualify for a new number. Everyone else should spend the energy on freezes and monitoring instead of chasing a new one.

A replacement Social Security card is a different thing. Lost the card? In most states, you can apply online for a free replacement. That does nothing if the number itself is the thing that is compromised.

6. File a police report when it actually helps

A police report is not step one. It earns its keep once you find real fraud: it backs your disputes with lenders and it can support steps like the extended fraud alert. Your FTC Identity Theft Report is enough for that on its own.

Go to your local police department with your FTC Identity Theft Report, a government-issued photo ID, proof of address (a utility bill or lease works), and anything documenting the theft, like fraudulent bills or IRS notices. Ask for a copy of the report before you leave. You will need it again.

7. Watch for tax fraud, benefits fraud, and the scams that follow

Stealing the number is step one. Cashing in is step two, and it usually looks like this:

A tax return you did not file. If the IRS rejects your e-filed return as a duplicate, or you get a notice about wages you never earned, follow that notice’s instructions exactly. It may direct you to file Form 14039, the Identity Theft Affidavit.

Benefits claimed in your name. Check your SSA earnings record for mystery employers. If someone is collecting Social Security benefits as you, report it to the SSA Office of Inspector General at 1-800-269-0271.

Targeted phishing. After a large breach, expect calls, texts, and emails that quote the last four digits of your SSN to sound legitimate. Some fake breach alerts are scams in themselves. We saw that pattern up close when a fake ASOS hack notification went out to users’ phones. Remember the rule from step 4: the IRS never asks for your IP PIN by phone, email, or text. Treat anyone who does as a scammer, because that is what they are.

Take the free credit monitoring. In this breach, affected people are being offered a year of free credit monitoring and identity-restoration services through IDX. Questions about the breach? Call IDX at 1-855-744-4556 or visit response.idx.us/DMDC. Enroll — it is free detection you would otherwise pay for, and it does not stop you from freezing too.

Watch for fake breach emails using the real letter. The notification letter has circulated publicly, which hands scammers a ready-made template: same letterhead, same wording, but with a malicious “enroll here” link. If you get a breach notice by email, do not click its links. Go to the company’s site directly or call the number from the physical letter.

>

The same drill applied when the Oracle Health breach exposed nearly 20 million records: freeze, report, monitor. The SSN version just matters more, because the number never expires.

Sources

Related reviews and guides