From what I've read, the deduplicated data set (number of unique social security numbers) is closer to 90 million Americans, which makes this smaller than the Equifax data breach of 2017.

Still, at this point, you should assume that your SSN has been leaked in at least one data breach. I know of at least three that impact me, this one included.

You can check if you are in the data breach at this site. Enter your first name, last name, state, and year of birth, and it'll display any entries in the breach that match (minus the full SSN obviously).

Everyone should use online accounts with Equifax/Transunion/Experian (also, Chexsystems for bank deposit accounts) to freeze their reports when you're not actively applying for credit (you can schedule a thaw on the credit reports or unfreeze instantly whenever you want), and should request an Identity Protection PIN (IP PIN) from the IRS.

(An IP PIN makes it impossible for a paper or electronic return to be accepted by the IRS. Sometimes fraudsters will fake a return to cash out the refund via direct deposit. Your legitimate return gets rejected because a return was already accepted and then you spend months going back and forth with the IRS to get it resolved. If you have the IP PIN, bad actors trying to file a fake return under your SSN will have them automatically rejected. This used to require proof of active identity theft to get, but now the IRS lets people get IP PINs for tax years no excuse required since 2021.)