Are SSNs stored in plain text?
Here's a screenshot they uploaded as proof of the hack: https://pbs.twimg.com/media/E848JkGUUAIhIq5?format=jpg
You can see that it's running Goldengate, software used to replicate Oracle or other databases. So it probably had all the DB credentials needed to just export the whole database.
Well at least they weren't lying.