Yeah, good luck showing damages. You basically have to wait until your identity is used for fraud, and then probably tie it specifically to the breach.