While this is alarming, SSNs have been defacto public for a while because of numerous other breaches. Any institution issuing credit on the sole basis of SSN number + other easily aquired demographics is negligent. The burden of "Identify theft" should at this point is no longer on the victim but the defrauded institution.