Exposed Database Contains Billions of Social Security Numbers at Risk
- Securityish
- Privacy & Personal Security
Quick Summary
In January, UpGuard researchers discovered an exposed database containing approximately 2.7 billion records of Social Security numbers and 3 billion email addresses and passwords. The data, hosted by Hetzner, likely compiled from multiple breaches, raises significant identity theft concerns. Notably, one in four Social Security numbers in a sample appeared valid, potentially affecting 675 million individuals, highlighting ongoing risks from past data breaches.
The Securityish Brief
In January, UpGuard identified a massive exposed database containing sensitive personal data, including approximately 2.7 billion Social Security numbers and 3 billion email addresses and passwords. The database was hosted by the German cloud provider Hetzner, which was notified on January 16, leading to the data’s removal on January 21. The origins of the data suggest it may have been compiled from various historic breaches, including a 2024 breach of the background-checking service National Public Data.
Researchers analyzed a sample of 2.8 million records, revealing that many passwords referenced popular culture from around 2015, indicating the age of the data. Despite the age, the data remains valuable because individuals often reuse email addresses and passwords across multiple platforms, making them susceptible to credential stuffing attacks. Additionally, Social Security numbers are critical for identity theft as they rarely change throughout a person’s life.
Pollock, the director of research at UpGuard, noted that one in four Social Security numbers in their sample appeared valid, suggesting that around 675 million records could potentially be legitimate. This raises alarms about the long-term risks posed by such exposures, as many individuals may not be aware that their information has been compromised.
The findings echo concerns from previous breaches, such as the 2015 US Office of Personnel Management breach and the 2017 Equifax breach, which continue to have repercussions for affected individuals. Pollock emphasized the importance of recognizing that exposed data can remain a threat for years, as cybercriminals may exploit it long after the initial breach.
Key Takeaways
- Regularly monitor your financial accounts and credit reports for unusual activity.
- Consider using a password manager to create and store unique passwords for each account.
- Enable multi-factor authentication on accounts that offer it to add an extra layer of security.
- Be cautious of phishing attempts that may arise from leaked personal information.
- Stay informed about data breaches and take action to secure your accounts if your information is compromised.
Key Terms & Concepts
- Social Security Number: In this article, a Social Security number refers to a unique identifier assigned to individuals in the United States for tracking earnings and benefits.
- Credential Stuffing: Credential stuffing is a cyber attack method where stolen account credentials are used to gain unauthorized access to user accounts.
Read the original article here: https://www.wired.com/story/a-mega-trove-of-exposed-social-security-numbers-underscores-critical-identity-theft-risks/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
