Conversely getting 100k SSNs vs spending a significant amount of time and/or money on a handful is a different story. I'm not disputing that SSNs might be easy

Conversely getting 100k SSNs vs spending a significant amount of time and/or money on a handful is a different story. I'm not disputing that SSNs might be easy to obtain, but obtaining them at scale via breaches as this are apples and oranges. One is targeting a company because it is known to handle this information, the other is targeting an individual. The difference is simply data dispersion. If a breach dump ends up on the public Internet everyone has access to that data, worst case scenario, infinitely. Individual targeting has a similar risk but the overall impact is smaller. Not sure what your point is with the "head in the sand" comment - I happen to work for a security company in an engineering role. I'm not, in any way, defending security through obscurity or the way SSNs are used or (mis)handled. Reading through these comments it is apparent credit agencies don't even get it - and that is disturbing in itself. But stating that you "doubt a whole lot of SSNs were gathered in this hack that weren't already effectively disseminated widely" is, in fact, a head-in-sand approach compared to doing everything you can to preserve and prevent in the mean time. I, personally, don't agree. edit: added "compared" to second to last sentence for clarification