SSNDOB

» see ssndob.ws as it lived, on the wayback machine

~ the obit ~

The thing to look at first is the price list, because it tells you what a person was worth wholesale. In 2013 a full record on an American, meaning a name with the address and the social security number attached, cost fifty cents. A credit report was fifteen dollars and a background check twelve. You could search the catalog by date of birth for a dollar, or by zip code for a dollar fifty.

SSNDOB was not one website but a set of them, starting at ssndob.ru around 2012 and later answering at ssndob.ws among others. The administrators advertised on dark web forums and ran customer support. They monitored the sites the way any operator would. Nearly 22 million dollars in bitcoin came in from April 2015 onward, and the catalog held personal information on roughly 24 million people in the United States, with British dates of birth on the side.

The early stock came from breaking into the firms that already held it. LexisNexis and Kroll Background America were both compromised, which is the detail worth stating plainly: the raw material was not taken from individuals. It was taken from brokers and screening companies that had already collected it and were selling it legally.

On 7 June 2022 the seizure went through. Police in Cyprus took the servers, which were held by a Cyprus resident who cooperated, and the US Department of Justice seized the domains the same day. Prosecutors put the sales figure at more than 19 million dollars.

~ the rap sheet ~

~ who ran it ~

Vitalii Chychasov, a Ukrainian national, was picked up in Hungary in March 2022 while the marketplace was still trading, and extradited to the United States that July. He pleaded guilty, and on 27 November 2023 a federal judge in Tampa sentenced him to 96 months with a five million dollar forfeiture order on top.

Eight years is a real sentence in this category, which usually ends with a seized server and a suspect living somewhere without an extradition treaty. The arrest happening three months before the takedown is the part that reads like actual police work rather than a domain grab.

~ what it cost ~

A seizure notice does not undo any of it and there is no version of this where it could. Twenty four million records were sold once and copied many times over, and a social security number cannot be rotated the way a password can. The people in that catalog were never customers of SSNDOB and never had any relationship with it, so nobody notified them and there was no breach letter to read.

~ the part that made it possible ~

This one sits outside my geography entirely. Turkey has its own national ID number and its own leaks, and the American social security number is a foreign object to me: a nine digit string doing the work of an identity document while never having been designed as one.

That is the design decision the whole market ran on. A number that cannot be changed and that proves who you are to a bank is worth buying forever, which is how the price settles at fifty cents and the inventory never spoils.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »