A CSRF attack means that a website tricks a user into making a page request on another website they didn't want to make. This can be used to trick the user into performing an action on that website they don't intended to perform.
I could, for example, ask you to click this amazing link (really, it's cool!), and accidently cause you to delete your account on example.com (just an example - there is no such script on example.com). When I would have more control over this website, I could use a script- or HTTP redirect, so no social engineering would be necessary. But any response to that action would be sent to you, not to me. That means when the action is non-destructive and only reads information without changing it, a CSRF would be pointless. In the worst case the user would wonder why they are suddenly redirected to the website showing their social security number.
But there is one way for a website to gain information from a different website in the context of the user: xmlHttpRequest. Normally, same origin policies apply and prevent xmlHttpRequests from crossing domain-borders. But this restriction can be overridden by the Cross-Origin Resource Sharing settings on your webserver. When you accidently enable CORS for the other website (or all websites), they can send requests in the context of your users to your website and read the response. When you want to know how to check or change the CORS configuration on your webserver, refer to its documentation.