Absolutely. The real moral liability here rests with any organization still using SSNs as a form of secret or authenticating credential. Spend the legal fees to go after these people and the problem will be truly solved.