Ah, so finally the detail. The site was apparently an ASP.NET site, and they were putting the whole SSN into the "VIEWSTATE" object.<p>Which looks something like this in the html:<p><input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="BASE64STUFFHERE="><p>There is a choice to encrypt it, but I'm skeptical how useful that is, or that it was enabled in this case.<p>So the "hack" was "view source" -> decode some base64 data sitting in plain sight.<p>Edit: A little bonus. This bizarre video from a PAC the governor started, still trying to call this "hacking": <a href="https://www.youtube.com/watch?v=9IBPeRa7U8E" rel="nofollow">https://www.youtube.com/watch?v=9IBPeRa7U8E</a>