In fall of 2000 when I started college, we used to have SSN numbers publicly listed as student ids :). I never thought much of it back then. Good old days when you didn't have to worry about being identity hacked.
What harmful thing can an attacker do with it that doesn't require further identity verification?
Is this an urban legend?
So, for example, "I" had "my identity" "stolen" according to Verizon.
In reality, some criminals learned facts about me and then Verizon happily let them run up thousands of dollars in phone charges in a two month period. (I assume this is part of a larger scam where a 900 number pockets the charges?) This had nothing to do with me, but Verizon then polluted my credit history by falsely reporting the unpaid charges as being mine. So even though there were clearly two parties at fault—the criminals for the fraud and Verizon for not verifying the ID of the person getting the phone line and then falsely harming my credit reputation—I, an uninvolved third party, was made to do the legwork of cleaning up the mess. It's really scandalous that we allow this, but the PR of "identity theft" has been quite good at brainwashing the public.
The summary is that the USA does not have an official national person identity number. The SSN is the closest approximation, so it is being (ab)used as one. This is despite that it is explicitly not designed for it and has some qualities which make it less suitable (the numbers are small and very predictable).
In general, nearly every national-identity-system suffers from a contradiction between assigning identities and identifying. Where the number you get assigned is simultaneously your identity and a secret you use to establish your identity. There are initiatives to solve this using cryptography, but this is complicated by political attitudes towards privacy and government tracking. I dare say in the USA this is more pronounced due to both the problem and the political attitude against solutions being more pronounced.
As personnel management became more sophisticated and formalized, a unique identifier was needed that was guaranteed to refer to one and only one person. And since SSNs already existed and were guaranteed unique, most of them just used those rather than inventing a unique identifier of their own.
Yeah.... about that: https://www.cio.com/article/3004596/a-tale-of-two-women-same...