While we firmly believe the risk is minimal, we viewed our primary responsibility was to communicate with the affected recipients to let them know it happened.
We believe the risk to be minimal and the only person who would recognize this as a social security number would be the recipient, and in most cases, recipients didn't even notice.