Shouldn't be a problem for a dedicated criminal, but not as easy as submitting SSN and date of birth into a web form, so can't be done cheaply in bulk.