Is it just for shipping sales?
The SSN# inquiry is required for OfferUp's cashless payment (for deposits) system, which does include the shipping process, especially for sellers (so that they can get paid).
Stripe (OfferUp's payment processor) is required to ask for your personal info due to the Bank Secrecy Act (BSA) and the Customer Identification Program (CIP), which were implemented after 9/11 under the US Patriot Act.
But it CAN be stored by Stripe.
All 3 major credit reporting companies have been hacked within the the last decade. In addition, back in the day, when Fair Issac Corp (FICO) had its HQ in California their firewall system was a joke, as I personally saw the setup.
FYI, banks get hacked all the time. You only get notified if your account has been affected by it (loss of funds...but you don't get notified IF the hackers had access to your personal info).