Microsoft responded saying that it does not use social security number in its Xbox Live accounts, but that the hackers were effectively “daisy-chaining” by social engineering one of Microsoft’s partners (see: “affiliated companies in the statement above) and gaining enough information to bypass Microsoft’s “security proofs” or the information it collects to make sure you are who you say you are.