Comment by pc86
The real kicker is trying to prove which leak your SSN came from. If your SSN gets leaked by 3 different companies, and 6 months later someone uses your identity to commit some crime, you can't have each company share 1/3 of the blame.
I don't see why they couldn't all share the full blame ?
It's not like there's a "conservation of blame" law.