Perfectly legal (as long as the SSN isn't disclosure for a fraudulent purpose). Why would you think this is a crime?
I don’t assume it’s a crime. I assume it’s NOT a crime, but not for the reasons you’ve given. I’m assuming they got the information from a source that had it legally.