They've been leaked ever since they were shared with anyone other than yourself and the Social Security Administration. Any system using an SSN as a password is fundamentally broken - just the fact that a company can verify your SSN is proof that it's an authentication mechanism known to more than only yourself... (Ok, they could be hashing it, or at least the first five digits of it... but they're not.)