I had this happen to me. The hacker used freecreditreport.com (Experian) to pull a credit report using the information an old employer leaked. They took the information from my credit report and tried to change the address of my credit cards to a UPS store mailbox and get new cards issued.

Fortunately one card was with a credit union that gave me the fraudulent address. I filed a police report in the jurisdiction where the UPS Store was located. Nothing came of the compromise, but at least I had a record if something happened later.

I also got the email address of the hacker from freecreditreport.com, but it was useless. The only way I found out that my credit report was pulled through freecreditreport.com was due to my employer (not the leak) getting employees accounts with Experian as a perk. When I contacted Experian, the rep noticed I had two accounts, one through my company and one through freecreditreport.com.

How did you figure it out?