What to Do if Your Social Security Number Was Leaked

In short: A leaked Social Security number, CPR number, National Insurance number or other national ID isn't swapped out as a matter of course after a breach, so the response is to lock down credit, watch for tax and loan fraud, and report misuse through official channels, as described in guidance from the Social Security Administration's Office of the Inspector General, Denmark's Sikkerdigital.dk, and the UK's ICO identity theft guidance. The steps differ by country, but the goal everywhere is the same: catch misuse fast, since the number itself keeps following you.

If a company you dealt with just told you your national ID number was in a breach, the first instinct is to want a new number. That's not how these systems work. What follows is a country-by-country rundown of what to actually do in the US, Denmark, the UK and the wider EU, based on official guidance from the agencies that run these programs.

What should I do immediately if my Social Security number was leaked?

Check the Social Security Administration's Office of the Inspector General guidance first. It tells people whose number has been "lost, stolen, shared, or exposed in a data breach, but your number hasn't been misused yet" to use IdentityTheft.gov's lost-or-stolen tool to learn the steps for checking, freezing and monitoring their credit, according to the SSA OIG's fraud-reporting page. If the number has already been used to open an account or make a purchase in your name, the same guidance says to "report it at https://www.identitytheft.gov/ and find out what to do next to recover."

If your physical Social Security card itself was lost or stolen, the SSA OIG says to file a police report with your local department and apply for a replacement card, as described on the same SSA OIG page. That's a separate issue from a data breach exposing the number digitally — a lost card is a document problem; a leaked number in a database is a fraud-monitoring problem, and both can apply at once.

Why isn't a new Social Security number the answer?

Replacement isn't part of the standard breach response: the SSA OIG's guidance sends people whose number has been exposed toward checking, freezing and monitoring credit, not toward a new number. Nor would a new one erase the old one — the records, accounts and files already tied to it stay tied to it. The practical consequence is that a leaked SSN, CPR number, or National Insurance number can resurface in fraud attempts years after the original breach. That's why every country's official advice below centers on detection — credit freezes, fraud alerts, credit warnings, bank monitoring — rather than on getting a replacement number. If you've been through this before with another leak, our data breach checklist covers the general steps that apply regardless of which number was exposed.

How do I protect my credit after an SSN leak?

The official starting point, per the SSA OIG, is checking, freezing and monitoring your credit once a number has been exposed. Beyond that, keep an eye on statements from your bank and credit card issuer for transactions you don't recognize, and pull your credit report periodically to check for accounts you didn't open. None of this requires a new SSN — it requires watching the accounts tied to the existing one.

What if my national ID number was leaked in Denmark?

Danish authorities' advice centers on two things: vigilance and a credit marker. Denmark's digital security agency, in guidance published after unauthorized access to citizens' CPR information, tells people to watch closely for text messages, calls and emails in which the sender uses personal information about them, in the period following a leak, according to Sikkerdigital.dk.

If there's concrete suspicion that someone is misusing your CPR number, you can set a kreditadvarsel — a credit warning — through borger.dk. Sikkerdigital.dk describes it as a marking placed in the CPR register that makes it harder for someone else to take out a loan or credit in your name. There's a trade-off worth knowing before you set one: the same guidance notes that once the marker is in place, it can also become harder for you to get loans or credit from companies — meaning the protection and the inconvenience come as a package, per Sikkerdigital.dk.

Two other pieces of Danish guidance are worth following directly. Never use your CPR number, whole or in part, as a password — if you do, Sikkerdigital.dk recommends changing it. And report actual fraud attempts — phone or SMS scams, misuse of card details, or scams involving buying or selling goods online — to the Danish police, not just to your bank. Citizens who need help, including setting up a kreditadvarsel, can call the Cyberhotline run by Denmark's Agency for Societal Security at 33 37 00 37, per Sikkerdigital.dk. For background on a specific large-scale CPR exposure, see our CPR breach story.

What if my national ID number or passport was leaked in the UK?

The UK's data protection regulator, the ICO, gives three concrete steps. First, report all lost or stolen documents containing personal information, such as passports, driving licences, credit cards and chequebooks, to the organisation that issued them, according to the ICO's identity theft page. The ICO's guidance doesn't name National Insurance numbers specifically, but the same document-reporting principle would reasonably apply if a National Insurance number was tied to a lost or stolen document.

Second, tell your bank, building society and credit card company about any unusual transactions showing up on statements, and request a copy of your credit file to check for suspicious credit applications you didn't make, the ICO says.

Third, report the theft of personal documents and any suspicious credit applications to the police and ask for a crime reference number, the ICO says.

What about an EU national ID or passport leak outside the UK?

Rules vary by EU country, and there's no single EU-wide process described in official guidance. Denmark's approach — a credit warning plus police reporting for digital fraud, described by Sikkerdigital.dk — is one worked example from inside the EU. The general pattern that carries across borders: report a lost or stolen physical document (ID card, passport, driving licence) to the authority that issued it, watch your bank and credit accounts for activity you didn't authorize, and report suspected fraud to your national police force or data protection authority rather than assuming the breached company will handle it for you.

How do I report tax fraud if my SSN was used illegally?

If someone used your Social Security number on their own federal tax return, or the IRS tells you your refund can't be processed because your number was already used, contact the IRS at the phone number on the IRS notice you received, or visit the IRS's Identity Protection website, per SSA's OIG guidance.

Before filing anything, know that the IRS itself says most people in this situation don't need to submit extra paperwork. The agency's own notice states plainly: "In most cases, taxpayers do not need to complete this form. Only victims of tax-related identity theft should submit the Form 14039, and only if they haven't received certain letters from the IRS," according to IRS guidance on Form 14039. In other words, check what letter or notice the IRS actually sent you before assuming you need to file the identity theft affidavit — filing it unnecessarily just adds a step to a process that may already be underway.

Checklist: what to do once your national ID number has leaked

1. Confirm what was actually exposed — the number alone, or the number plus a physical document like a passport or Social Security card.
2. In the US, use the lost-or-stolen tools described by the SSA OIG to check, freeze and monitor your credit before any misuse happens.
3. If your Social Security card itself was lost or stolen, file a police report and apply for a replacement, per the SSA OIG.
4. In Denmark, if you suspect concrete misuse of your CPR number, set a kreditadvarsel via borger.dk, as described by Sikkerdigital.dk, understanding it may make it harder to get loans while it's active.
5. In the UK, report any lost or stolen passport, driving licence or similar document to the organization that issued it, per the ICO.
6. Everywhere: tell your bank and credit card issuer about any transaction you don't recognize, and request your credit file to check for accounts opened without your knowledge.
7. Report suspected fraud to the police in your country — in Denmark that means the Danish police for scams like phone, SMS or card-data misuse; in the UK, report to the police as the ICO describes and get a crime reference number.
8. In the US, if the IRS has notified you that someone used your SSN on a tax return, call the number on that notice or check the IRS Identity Protection guidance before filing Form 14039 — most people don't need to.
9. Go back and work through the general response steps in our data breach checklist for anything specific to the company that was breached, such as password resets or account notifications.

None of these steps erase the leaked number from wherever it ended up. What they do is make it harder for someone else to use it successfully, and give you a paper trail — a crime reference number, an IRS case, a credit freeze — if they try anyway.