>The prevailing theory today is that the data was stolen by a nation-state for spying purposes, not by criminals looking to cash in on stolen identities. Is th

>The prevailing theory today is that the data was stolen by a nation-state for spying purposes, not by criminals looking to cash in on stolen identities. Is this not the perfect scenario for a spy agency? With 143 million real person identifies, one of them is bound to look like one of your undercover agents, and you know all of their authentication secrets. It's pretty true for a identity thief too, now that I think about it. A massive wave of fraud following the breach would have rendered the data useless as everyone ceased trusting SSNs and other classes of stolen information. Sitting on it for a while, and then executing a fraud scheme that doesn't go too far above the baseline identity fraud rate would arouse less suspicion.