A gloved hand reaching for a package containing a Social Security card, labeled with a red price sticker that reads “Dark web special $1.99.”

The real price of your
Social Security number

Criminals can buy your SSN online for around $2 — less than a cup of coffee to go.
But the damage from a stolen SSN can follow you for years.

About the research

Coveron, supported by NordLayer Intelligence, a threat exposure management platform, investigated dark web forums and private messaging channels where online criminals deal in stolen personal information. We analyzed the prices of SSNs on the dark web market, how these SSNs change hands, and what buyers do with them. We also surveyed 1,005 U.S. residents aged 18 to 74 to understand how safe Americans feel about their personal data.

The findings were alarming. Social Security numbers are among the cheapest and most commonly traded pieces of personal information on the dark web. And by the time most people learn their number was stolen, criminals have had it for weeks.

1 in 4 data breaches expose SSNs

Over your lifetime, you share your Social Security number with government agencies, employers, banks, and hospitals. And when they get hacked, your SSN is often part of what hackers steal. In fact, 190 out of the 733 U.S.-linked dark web databases we analyzed contained leaked SSNs — that’s roughly a quarter of them.

Much of that stolen personal data came from a single source — the MOVEit vulnerability exploited by the CL0P ransomware group, the largest driver behind the surge in leaked SSNs.

1 in 4

U.S. data breaches expose SSNs.

5,885

dark web posts found selling data packages with SSNs.

Under $2

for a stolen SSN on the dark web.

Your SSN might be for sale — right now

Our researchers found 5,885 active posts on dark web forums and private channels offering to buy or sell data packages that include Social Security numbers. As you can see in the dark web listing example, criminals get bulk discounts — buying 100 or more stolen data packages drops the price to under $1 each.

A dark web listing selling stolen personal data packages at bulk discounts.

Source: A dark web listing offering packages of stolen personal data of U.S. citizens.

How much does your SSN cost?

Social Security numbers are cheaper than you think. On the dark web, a stolen SSN can cost under $2 — less than a dozen eggs or a Big Mac. See how its price compares to the prices of things you buy every day:

Item

Price

Ground beef chuck (per lb)

$6.85

A Big Mac

from $5.79

Milk (per gallon)

$4.31

Gasoline (per gallon)

$4.09

A dozen eggs

$2.19

Fresh chicken (per lb)

$2.01

Social Security number

up to $2.00

White bread (per lb)

$1.82

Source: Consumer Price Index (CPI), U.S. Bureau of Labor Statistics, July 2026.

A woman looking at her smartphone while holding a Social Security card.

Why SSN theft is so dangerous

Your Social Security number is permanent. Unlike a credit card number, you can’t cancel it and get a new one if it’s stolen. The Social Security Administration only issues new SSNs in extreme cases — like ongoing harassment or documented identity theft that has caused serious, long-term harm. Even then, the process can take months. And your old number doesn’t disappear. It stays in databases, tied to your name and history, and criminals can keep using it.

What criminals do with your SSN

When criminals get your SSN, they can steal your identity — and ruin your finances and legal record. Over the past two years, our researchers uncovered 5,885 posts on dark web forums where users discuss ways to put stolen SSNs to work. Armed with this unique identifier, they can bypass online identity verification, open crypto accounts, or apply for credit cards in your name. You may end up with debt you never took on and a wrecked credit score.

  1. KYC or verification bypass 2,493 (42%)
  2. Carding 2,056 (35%)
  3. Identity documents or fake IDs 1,670 (28%)
  4. Crypto or payment accounts 1,201 (20%)
  5. New credit or card applications 914 (16%)
  6. Bank drop or cashout 695 (12%)
  7. Tax refund fraud 311 (5%)
  8. Identity lookup or skip-trace 310 (5%)
  9. Loan applications 301 (5%)
  10. SIM or phone number porting 242 (4%)
  11. Unemployment or benefit fraud 117 (2%)
  12. Synthetic identity or CPN 85 (1%)
  • Category mentions (share of total)
  • Total: 5,885 dark-web forum posts
Source: Coveron and NordLayer Intelligence by NordStellar dark web analysis of forums and private messaging channels, June 2024-June 2026. Based on 5,885 posts.

How long before you find out?

When your data is stolen in a breach, companies are required to notify you. But that notification doesn’t come right away. Our research found that the median time between a data breach and public disclosure is 50 days. In some cases, it takes more than a year. That’s months where criminals have your SSN and you don’t even know it. It’s more than enough time for them to open accounts in your name, file fake tax returns, or drain your benefits.

50 days is the average lag time between a database compromise and public disclosure.
median 50 d
  1. Change Healthcare 9 days
  2. PowerSchool 19 days
  3. DaVita 21 days
  4. Yale New Haven 34 days
  5. FBCS 50 days
  6. Conduent 85 days
  7. Episource 86 days
  8. Evolve Bank 150 days
  9. DISA 381 days
Source: Data collected by Coveron and NordLayer Intelligence from public data breach listings on August 28, 2026.

What personal data do Americans worry about most?

We asked 1,005 Americans what personal information they’d be most concerned about seeing leaked online. The answer was clear — Social Security numbers top the list.

  1. Social Security number 71%
  2. Credit card details 62%
  3. Password 45%
  4. Driver's license 40%
  5. Home address 39%
  6. Tax return details 37%
  7. Phone number 30%
  8. Medical information 30%
  9. Email address 29%
  10. Passport 27%
  11. Intimate photos 25%
  12. Employment information 21%
Source: Coveron survey of 1,005 U.S. residents aged 18-74, September 2025.

Don’t wait to find out the hard way — use Coveron

Don’t wait 50 days to discover your credit score has crashed or there’s debt in your name. Coveron scans the dark web around the clock for your SSN, email address, phone number, and credit or debit card numbers. The moment your information shows up, you’ll know.

But Coveron doesn’t just warn you — it helps you fight back. Every alert comes with clear steps to lock down your accounts and data. And if a stolen SSN has already led to identity theft, we’re right there with you — with expert assistance and financial support.

A man using a laptop, with a Coveron credit score tracker displayed in the corner, showing a score of 791, labeled Excellent.

Dark web alerts

We scan the dark web around the clock for your personal information, including your SSN, email address, phone number, and credit or debit card numbers. The moment your data shows up for sale, you get an instant alert with clear steps on how to protect yourself.

Recovery support

If criminals steal your identity, you get a dedicated case manager who takes the lead — handling legal issues, replacing your documents, and guiding you through the recovery process. You’re never alone in this.

Identity theft insurance

Coveron includes up to $2M in identity theft insurance to help cover the costs of recovery — so a stolen SSN doesn’t turn into a financial disaster.

Logos of research partners NordStellar and Coveron.

Methodology

This research is based on three sources: a dark web analysis, a consumer survey, and public data breach listings.

Dark web analysis. Coveron and NordLayer Intelligence by NordStellar, a threat exposure management platform, analyzed dark web forums and private messaging channels for posts about buying and selling personal data packages that contain Social Security numbers. The research ran from June 2024 through June 2026, and the data was collected using the NordStellar platform. We excluded Telegram groups from the post count due to heavy spam — though our researchers noted significant automated SSN-selling activity there too.

NordLayer Intelligence by NordStellar does not capture all data breaches, since not all incidents are publicly disclosed or leaked. It also cannot find every dark web mention of Social Security numbers, given the hidden nature of the dark web.

Press materials

Download assets and infographics from this research.

For interview or press inquiries, contact us at [email protected]