Not using usual name for identifying reasons
I have spent two days now changing passwords and speaking to the fraud departments of sundry financial service sector companies
What I did learn:
Make sure you have an account with all the credit ref agencies. If YOU don't - someone else MIGHT: and then they would have access to.......
All of your personal data, credit history, past addresses and anything else of interest.
The bastards set up an Equifax account in DPs name and had enough info to get into it: so they know literally everything. Passwords can be changed but your actual history can't. They reported our phones stolen the other day, and they were barred - then did it again yesterday and got as far as ordering a new sim in a store. They've tried to get credit and loans from quite a few companies unsuccessfully. We've had to register with CIFAS as at risk of fraud so anything applied for in our names is super high security.
So: something you can do is stake your claim - sign up for the three agencies (Equifax, Experian and Call Credit) - sadly you have to put you credit card details in and then remember to cancel after the 30 day trial, but you will still have an account. DP didn't and they just set one up!
I have Lastpass set up after the last MN webchat so passwords are secure, but personal details can't be changed.