I would immediately add a initial 90 day fraud alert online. The keep up, don't stop, and devote time to investigating this matter. If you see that there are inquiries and/or accounts that are not yours then file a police report and then have a seven year fraud alert added and make sure that you add your cell phone number to the alert. Take a close look at any inquiries that you know are not yours. If you see any then contact the company of each inquiry. Also if there are any inquiries then compare the one's on the inquires and see if the name of the business matches the account.
This is what I have done. I do my monitoring through Exquifax. In addition I pay $ 2.00 extra to add a credit freeze which I can lock and unlock at any time except in the middle of the night. It 's called credit control. For another $ 2.00 I am having my social security number, credit & debit cards monitored. So anytime those numbers are used online I get an alert.
On a last note, before any fraud alert expires you can send in a letter to each credit bureau and ask them to switch the fraud alert to a consumer statement. As long as you put it in writing Transunion will leave the statement on there indefinitely but the other two credit bureaus will only allow seven years. Make sure that if you ever change your cell phone number that you contact the credit bureaus so that they can update the new number on the statement or fraud alert.