Report: Your Social Security Number Costs Less Than a Big Mac

Researchers examined dark web marketplaces and found Social Security numbers selling at bargain basement prices, providing criminals with inexpensive access to sensitive information.

Stolen Social Security numbers can cost less than $2 each on the dark web, which is cheaper than a Big Mac, a dozen eggs or a gallon of milk, according to new research from the identity protection company Coveron.

Coveron, with support from NordLayer Intelligence, examined dark web forums and private messaging channels from June 2024 through June 2026, identifying 5,885 posts that involved the sale of personal information packages containing Social Security numbers. Some listings offered bulk discounts, dropping prices below $1 per package.

underscore the risks associated with data breaches affecting government agencies, schools, healthcare organizations and other institutions that collect and store sensitive personal information such as Social Security numbers. The unique identifiers can be used to bypass identity verification, apply for credit cards, create fraudulent identification documents and open cryptocurrency or other payment accounts. They are also used for public benefit fraud, tax fraud and unemployment fraud.

And Americans are worried those numbers being exposed, according to the research. Of 1,005 U.S. residents ages 18 to 74 surveyed in September 2025, 71 percent said they were most concerned having Social Security numbers leaked online, while 62 percent were worried credit cards, and 45 percent passwords.

There have been multiple leaks contributing to the massive number of leaked Social Security numbers, and the report identifies the 2023 exploitation of the

file transfer vulnerability as “the largest driver behind the surge in leaked SSNs.” As previously reported by

the CL0P ransomware group exploited a vulnerability in widely used file-transfer software, stealing sensitive information from organizations and their third-party service providers in a sprawling supply-chain attack.

Besides MOVEit, Coveron researchers noted that PowerSchool, Change Healthcare, Conduent and others took between nine and 381 days to publicly disclose breaches, with 50 as the median.

from the Internet Theft Resource Center, PowerSchool broke a record by sending more than 71.9 million victim notices, making it the largest breach notification associated with a single compromise.