There was a time when identity theft felt like a rare, sophisticated crime — something that happened to other people, carried out by shadowy hackers with unusual skill. That picture is badly outdated. Our latest research at Coveron found that a stolen Social Security number now sells for under $2 on the dark web. For less than the price of a dozen eggs, a criminal can buy everything they need to open accounts in your name, file a fake tax return, and begin wrecking your credit.
Our latest research at Coveron drew on dark web data collected from June 2024 through June 2026, spanning marketplaces and private messaging channels where SSNs are priced, traded, and exploited. Within that dataset, we identified 5,885 active posts offering data packages containing SSNs. A single record costs up to $2, but bulk buyers purchasing 100 or more records pay less than $1 each. Your identity is no longer just a target. It has become inventory — raw stock in a supply chain where criminals buy, bundle, and resell personal data like any other commodity.
A $2 purchase with an open-ended payoff
The low price is shocking, but the breadth of what a criminal can do with it may be just as unsettling. Our analysis of dark web discussions identified the most common uses — bypassing KYC and identity verification checks, opening new credit and card accounts, setting up bank drop and cashout accounts, filing fraudulent tax refunds, applying for loans, porting SIM cards, claiming unemployment and government benefits, and building synthetic identities.
Unlike a stolen password, an SSN keeps paying out. One criminal buys it to open a credit card; another buys the same number to file a tax return in your name. Each new buyer finds a fresh way to monetize it. Meanwhile, the victim is saddled with debts they never took on and accounts they didn’t open.
There is also no quick fix. The Social Security Administration issues new numbers only in extreme circumstances, and even then the process can take months. And unfortunately, even with the issue of a new number, the old number stays tied to your name and history in databases indefinitely, creating complications that can require years of monitoring and administrative effort to resolve.
The 50-day danger zone
The timeline when consumers find out about their SSN breach is also troubling. Companies are legally required to notify breach victims, but that notification is rarely immediate. Our analysis of publicly disclosed breach timelines found a median gap of 50 days between a breach and its disclosure. In some cases, it stretches beyond a year.
Fifty days is a long time to be exposed without knowing it. By the time a notification letter arrives, a criminal may have already opened several credit cards, filed a tax return, and resold the number to someone else. The gap between breach and awareness is where significant damage happens.
What you can do now
The commodification of SSNs is not something individuals can reverse. But you can shrink the window of opportunity criminals rely on.
First, monitor your personal data and act immediately after a breach. If your information is compromised, change passwords and enable two-factor authentication without delay. Acting quickly is important — every hour of delay widens the window for exploitation.
Second, freeze your credit. If you are not currently applying for new accounts, a credit freeze blocks anyone from opening accounts in your name, even with your SSN and personal details in hand. It is free, reversible, and a strong layer of defense against financial identity theft.
Moreover, be skeptical of unsolicited identity verification requests. Legitimate organizations do not contact you out of the blue asking you to verify your identity. If someone does, hang up and reach out to the organization directly through a number you have independently verified.
Finally, use an identity theft protection service. Even with fast detection, recovery after SSN theft is long and complicated. Choose a service that includes identity insurance, so if criminals do exploit your data, specialists handle the recovery process and your financial losses are covered.
Identity as a commodity
The uncomfortable truth is that identity theft has become an industrial process — impersonal, scalable, and cheap to execute. When your Social Security number costs less than a Big Mac, the barrier to entry for fraud effectively disappears.
That does not mean the situation is hopeless. It means the model of protection must change. We can no longer treat identity security as something we think about after a breach notification arrives. Monitoring, credit freezes, and recovery support need to be in place before the exposure happens — because by the time you find out, the criminal has likely already had a head start.
Your identity may be up for sale. The goal is to make sure it is worthless to whoever buys it.
________
About Tomas Sinicki, managing director at Coveron:
Tomas has been leading Coveron since day one in 2024, back when it was still NordProtect, and drove its transition to the Coveron brand. He keeps a close watch on how online scams and identity theft tactics develop and regularly shares his take on what’s happening and what people can do to stay protected. That real-world knowledge is also what shapes Coveron’s features — built to fight whatever threatens users’ identities and financial safety.
Join our LinkedIn group Information Security Community!
