It may be uncommon but unfortunately there are instances when data breaches and data thefts may occur. Common example is the Veterans Data Theft that received a lot of national publicity. There have been other instances as well such as someone managing to hack in to a college data system or a data tape being misplaced by a creditor. There was also some mention of a tape being misplaced by one of the credit reporting agency that notified the people whose data was to be in that tape and offered them a free credit monitoring service in order to help them keep a track of any unusual activity that might occur that you represent identity theft.
What you can and should do in such instances that you can add an initial security alert to your credit report. This lasts for a period of 90 days and alerts the vendor that the application is being made in the name of a person who could be a target of identity theft and subsequently credit fraud. If evidence is found of identity theft you can add a victim statement to the credit report that stays on for a period of 7 years. You will need to file a police report before you can add a victim statement to your credit report.
The Fair and Accurate Credit Reporting Act requires the vendors to take the fraud alert seriously and stake appropriate steps to verify the identity of the individual.