"Protecting social security numbers, names, and addresses is a different problem than protecting against access theft." . . . . .