SSN should just be considered public information at this point. It’s not secret so it cannot be treated as a password and it’s not even suitable as an identifier. It’s purpose is for tracking earnings, not identifying a person.
A national id number should have never been considered any more privileged or authoritative than a name in the first place, any business that does so is being criminally negligent.
I mean, that is why they exist, to replace names, or perhaps more accurately act as a surrogate key for names. The government specifically said don't use the SSN as a secret, and businesses did so anyway.
In Poland you can block your PESEL (SSN equivalent) to prevent this kind of fraud. One click in our government app or website. If PESEL is needed to confirm identify with a corporation you can unlock it temporarily.