Pretty much, yea (they usually look you up by SSN though).
Its supposed to only yo the "right" people (some kind of accreditation process), but there was that story recently where a credits reporting agency was selling the data directly to some identity thieves...
As in data with PII and not anonymized data?