An SSN on its own is a nine-digit string with no directory attached. What the markets sell is the assembled record: the number plus name, date of birth, address, phone and employment history, which Rapid7 calls the foundation of a full identity profile [9]. Rapid7 describes those records as searchable, reusable inventory rather than one-time goods, monetised repeatedly by different buyers [10]. The abuse paths it lists are fraudulent account opening, synthetic identities, identity verification bypass, false tax and benefit claims, and support for targeted social engineering [11].
For an executive, the public half of that profile is already filed. Regulatory documents, corporate biographies and social media supply the narrative detail, and the purchased half supplies the attributes a verification script treats as proof [12]. Rapid7's argument is that the combination raises the credibility of phishing, business email compromise and executive impersonation against the employer as well as the individual [13]. That is where the cost lands. A damaged personal credit file is the executive's problem; a wire approved on a convincing impersonation is the company's.
The percentages hide two figures worth doing by hand. 476 records across 395 people works out to 1.21 records per person, so at least 81 of those records duplicate someone already counted [14]. And 44.6% C-suite against 28.6% presidents, applied to 395 profiles, is roughly 176 and 113 people [20], a targeted slice rather than a volume crime, set against the more than one million identity theft reports the FTC logs annually [7].
The denominator is missing. These are alerts from Rapid7's own monitoring telemetry [1], so 476 is a count of what one vendor saw across the organisations it watches, with no population figure to divide it by. The naming wobbles as well: the second marketplace appears as Bankom in the share breakdown and as Bankomat further down the same post [17]. Minor, except that the name is the identifier a buyer or an investigator searches on.
Rapid7's proposed control is proactive dark web monitoring, catching exposure before it is weaponised [18]. That shortens time to know, but it does not shorten the life of the record, because an SSN cannot be deactivated the way a payment card or a session token can [6]. The durable control sits with whoever accepts an SSN, a date of birth and an address as evidence of who is calling: the helpdesk resetting MFA for a president, the finance team taking instructions from a CFO whose personal details all check out. Rapid7 also notes actors go after these people for their credit profiles and for corporate espionage and downstream extortion [8]. The credit profile is the part that gets monitored. The other two are the part that gets budgeted last.
