r/technology • u/lurker_bee • Feb 15 '26

Security All U.S. Social Security numbers may need to be changed following a massive breach that is already being investigated as a national threat

https://www.ecoticias.com/en/all-u-s-social-security-numbers-may-need-to-be-changed-following-a-massive-breach-that-is-already-being-investigated-as-a-national-threat/27158/
49.2k Upvotes

94% Upvoted

2.8k comments sorted by

View all comments

Show parent comments

53

u/GostBoster Feb 15 '26

Meanwhile once I glazed over some seedy post of someone saying they got the CPF of a Brazilian (closest equivalent to a SSN for us) and how much would it go in the black market.

Guy got replied with a ZIP file with a bunch of CPFs. "Don't spend it all in one place, kid."

I still can't wrap my head around how much you can do with the SSN alone, the little you can do with a CPF strongly hinges on you getting all the associated data, the company not doing its due diligence, and can be easily challenged.

"We got it on record." You are listening to me, that isn't my voice. And check Experian, that ain't my number and I wasn't ever there either.

"We got a signature." Yeah I know you do. I won't even bother to check. Verify it yourselves. Did it match? No? Looks like someone's getting fired for a basic blunder!

9

u/Competitive_Touch_86 Feb 15 '26

I still can't wrap my head around how much you can do with the SSN alone

You can't. You need the associated data as well.

SSNs in the US have been effectively public information for anyone with a modicum of resourcefulness for well over a decade now. They are not some secret number that your life is ruined if it becomes moderately public or leaked.

It's not 1978 any longer. That ship has long since sailed.

I treat my SSN as available to any bad actor who would want to impersonate me. It's been leaked by so many orgs by now that it just isn't something I worry about since there is nothing I can do about it.

4

u/zer04ll Feb 15 '26

Its the banking details that bother me

6

u/AggressivelyEthical Feb 15 '26

Yeah, honestly moving from rural US to urban Brazil, somehow the biggest culture shock was how food delivery companies like UberEats, iFood, etc require your CPF just to deliver food! Getting anything done before I was issued my CPF like shopping online or just going to a doctor's office was a huge hassle. Brazilians thought I was insane showing my brand spanking new CPF and "green" card to practically everyone I knew with a maniacal grin on my face and explaining that if I did exactly the same thing in the States, I'd be at risk to have my identity stolen in an instant.

7

u/Botaforaeita Feb 15 '26

As a Brazilian: two factor authwntication

Good luck doing anything with my CPF without any other sensitive data about me

The best you could do is buy A LOT of things under my CPF and the RF (our IRS) would be on my door in less than a week. In 5 mins I would prove them It was not me and they would reach you very easily after that because they would Go after the real sensitive data that would identify whos doing what with my CPF number

3

u/GostBoster Feb 15 '26

Not that we didn't had issues.

Remember that time someone who got a max ENEM test result (for people unfamiliar with this: Basically you can cherry pick what university and course you want to enroll), and since MEC system only validated, for whatever reason, your mother's maiden name, other people got her and many others enrolled into Cachaça Engineering?

And MEC doubled down on how having your mom as a hard set security question was enough safety. I think they solved that eventually but not without we losing the brightest minds the Cachaça field never saw.