EasyJet was the one hacked, the customers got their information stolen from the hack but were not themselves hacked.
Someone didn't steal my identity, someone stole from the bank using my identity. It should really be called "bank fraud".
The summary is: fraudster with fake ID featuring real data of my friend but fake photo managed to get loans and credit cards from several banks/companies. Since my friend lef the country, he was not getting any of the post. After years these orgs opened collection cases against my friend. Since he was not in the country, the courts have judged him as debt-evader and allowed collection agency to act against him.