Looks like an inside job.
Just think, people in other countries have access to more than a single card account. They have ALL of our credit information, SSN, employment history and god only knows what else, thanks to the outsourcing by CRA's. I've known enough people who've been victims of identity theft to know that the burden of proof is ultimately on the consumer. How in the world would you be able to prove that someone in Timbuktu stole your identity? It's hard enough proving it when they're here in the US. It's really messed up that people all over the world can know more about us than we know about ourselves and potentially use that information for their own personal benefit if they're shady. I have a real problem with that.