SSN and credit card numbers should not be considered secret. Anything that must be shared with a third party in order to make some kind of transaction cannot be considered secret; compromises happen, and once compromised, there is no way to make them secret again.

Brian Krebs, as a high-profile author on security who actively antagonizes black-market groups on the internet, is a common target. He has had all of his basic personal information posted on the internet publicly for some time. The credit cards that were used for this attack were all old, disabled ones, since he disabled them after the numbers were leaked; but apparently PayPal still has them listed on the account and so you can use knowledge of them to "prove" your identity to PayPal.