Encryption would have reduced the damage if encryption was done right. There's no reason for a front-end system to have access to SSN and with modern secure storage like Vault you can grant encryption(Write) and decryption(Read) rights specific to each app on your platform.
Having separate read and write permissions is entirely orthogonal to having encryption. That certainly would help (assuming the compromised system didn't need to have read permissions), but you don't need encryption to implement that and adding encryption doesn't imply that you've done it.
