The stolen Equifax data has never been found, and experts suspect a spy scheme

1. A bunch of people may bought "Credit Protection" from these companies to protect against criminals - who never had access to the data

2. Equifax, and other CIOs, will use this as an excuse for the piss poor security practice and data collection by crying "It was done by a super sophisticated nation state, there's nothing we could have done", while leaving logins on the equivalent of admin:admin

3. Who knows who has this information and what they could be doing to weaponize it.

>The prevailing theory today is that the data was stolen by a nation-state for spying purposes, not by criminals looking to cash in on stolen identities.

Is this not the perfect scenario for a spy agency? With 143 million real person identifies, one of them is bound to look like one of your undercover agents, and you know all of their authentication secrets.

It's pretty true for a identity thief too, now that I think about it. A massive wave of fraud following the breach would have rendered the data useless as everyone ceased trusting SSNs and other classes of stolen information. Sitting on it for a while, and then executing a fraud scheme that doesn't go too far above the baseline identity fraud rate would arouse less suspicion.