I would be surprised if anyone’s SSN isn’t on a dark web site. Being combined with other personal data is a problem, although the biggest problem is that credit companies treat easily found information as secret and let criminals easily impersonate people by knowing those few easily shared pieces of information without some kind of real security or easy way for people to contest fraud.