The bigger question, though, should be why are they storing the actual SSN? They can run a credit check and store only the result of the credit check and not al

The bigger question, though, should be why are they storing the actual SSN? They can run a credit check and store only the result of the credit check and not all the personal data they had to collect to run the check. Presumably, they do need some way to report delinquent accounts to the credit bureaus after the fact, but there's no reason why credit monitors can't use a tokenized system (i.e. submit the SSN to the credit bureau and receive back a UUID which has the singular purpose of reporting back to the credit monitors.) We really need to start attaching eye-watering financial penalties to companies that leak data so that we make the only sane decision be not storing that data in the first place. Collect it and shuttle it to where it needs to go...but under no circumstances commit it to at rest storage.