Personal data revealed in released JFK files

Over 60,000 pages related to the 1963 assassination of US President John F. Kennedy were released as part of President Donald Trump’s directive on March 17, 2025, and while readers will not find a conclusive answer to the main question—nor will the files put an end to surrounding conspiracy theories—one unplanned consequence was the disclosure of 400 Social Security Numbers (SSNs) and other privacy sensitive information amongst the rest of the records.

The records, which belong to the President John F. Kennedy (JFK) Assassination Records Collection, were previously withheld for classification but are now available to access online or at the National Archives at College Park, Maryland. The hard copy contains more data since the records have not been completely digitized yet. Some of the records had been made available previously but were redacted. Many, although not all redactions have been removed. And while the documents reveal new information, some of the records are not even directly related to the assassination but rather deal with covert CIA operations.

What has also drawn attention, however, is the leak of SSNs and private info.

This information mostly belongs to former congressional staffers. After a report by The  Washington Post of this oversight, the National Archives started screening the documents for Social Security numbers so that the Social Security Administration could identify living individuals and issue them new numbers. And according to an anonymous source those affected will receive free credit monitoring.

In total, the Post reportedly found 3,500 instances of SSNs, but many of them were mentioned more than once. Up to dozens of times.

With 100 staff members of the Senate Church Committee, established in 1975 to investigate abuses by America’s intelligence agencies and government, and 100 staff members of the House Select Committee on Assassinations, which investigated the killing of JFK, many of the affected have since become high-ranking officials in Washington.

For example, a former assistant secretary of state, a former US ambassador, and several prominent figures in the intelligence and legal fields are included in the leak.  

The release of the personal information in the JFK files is a major oversight caused by the sudden urgency put behind the release. The procedure has been called anything from “sloppy” to “incredibly irresponsible,” according to a former lawyer for the Trump campaign, Joseph diGenova.

We feel it certainly qualifies as a data breach when SSNs are leaked. Your Social Security Number is a key to many aspects of your life—financial, medical, and personal, especially when it concerns public figures that are already in the spotlight and in danger of harassment.

Or, as diGenova described it:

“It not only means identity theft, but I’ve had threats against me.”

Protecting yourself after a data breach

There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.

• Check the vendor’s advice. Every breach is different, so check with the vendor to find out what’s happened, and follow any specific advice they offer.
• Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you don’t use for anything else. Better yet, let a password manager choose one for you.
• Enable two-factor authentication (2FA). If you can, use a FIDO2-compliant hardware key, laptop or phone as your second factor. Some forms of two-factor authentication (2FA) can be phished just as easily as a password. 2FA that relies on a FIDO2 device can’t be phished.
• Watch out for fake vendors. The thieves may contact you posing as the vendor. Check the vendor website to see if they are contacting victims, and verify the identity of anyone who contacts you using a different communication channel.
• Take your time. Phishing attacks often impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions, and security alerts.
• Consider not storing your card details. It’s definitely more convenient to get sites to remember your card details for you, but we highly recommend not storing that information on websites.
• Set up identity monitoring. Identity monitoring alerts you if your personal information is found being traded illegally online, and helps you recover after.

Check your digital footprint

Malwarebytes has a free tool for you to check how much of your personal data has been exposed online. Submit your email address (it’s best to give the one you most frequently use) to our free Digital Footprint scan and we’ll give you a report and recommendations.