Also remember, they can sit on this data for years or decades. Most of this information (SSN, phone numbers, addresses, maiden names, etc.) doesn't change very quickly. So we might not see the repercussions a long time.

Another risk: if these attackers flood US banks with loan and credit card requests, using our identities, the banks won't know which are valid or malicious requests. They will have no choice but to stop responding. Chad, that will essentially cripple the commercial/ personal credit industry.