That truly sucks - the people most affected are also our society's most vulnerable and less able to fight identity theft

The only people who ever need my SSN are my current employer and Fed. gov and frankly I don't really like it that employers have that on file. It's rarely kept any more secure than a locked file cabinet.

Usually, organizations require social security numbers because that's how their database is designed and SSNs are an easy unique identifier (iow it's a cheap shortcut in the design). It's also irresponsible for exactly this reason.

When an business tries to tell me that they must have my SSN, I always find an alternative service. If they don't use technology appropriately enough to use something else as a unique identifier, I wouldn't trust them to keep my personal data secure.

Furthermore - having them stolen because they were physically moving them back and forth is inexcuseable. 9/11 gave us a lot of bad things, but one good thing it gave us was more options for securely backing up sensitive data remotely - precisely because of the risk involved in moving physical disks around.

In any case, I foresee a service in the near future that specializes in security and manages personal data, perhaps certifying that a person is who they say they are (which is the point to the SSN, right?). I predict security services will be the next internet boom because of cases like this.