Hi Mako. You ask what you should do. The first thing I would do is relax. The things to remember:
(1) One inquiry on only one bureau occured. This would have had a tiny effect on only one of your three scores.
(2) Even if the creditor had been uncooperative, the longest this tiny thing could have have affected your score is one year.
(3) The creditor is being extremely cooperative (more so than I think I have heard any creditor someone here complain about). There is nothing more you can do to make the creditor more sorry and cooperative than it already is. You even have a senior executive going to bat for you and pro-actively calling you.
The lesson learned here is never to authorize a pull of your credit or to do anything that could give a creditor the ability to do so if you know that a hard pull will freak you out. Customer service reps are legendary here on the forum for misunderstanding how the hard vs. soft distinction works and what their own company's policy is. As you descrbe it, there's no question that you did authorize a soft pull of your credit; it's just that you were sure (based on the rep) that it would be soft. Once you do that, you are hanging all your hope that it will be soft on an oral converstion with one rep who might easily be mistaken.
The other lesson is that companies do not need your social security number to pull your crediti. First name and last name and some other piece of identifying information (like street address) is enough. (Remember that services like Credit Karma pull your credit without ever having been given your social.)
Final observation: your situation is ceratinly not identity theft. That refers to criminals who discover your identiy (first name, last name, address, etc.) and then purport to be you typically to open bank accounts and credit cards and so forth. This is a case of a creditor being given a customer's name, address, etc. by the customer -- the creditor then used it once to look at your credit worthiness, not to open credit cards or bank accounts in your name. It's about as far from ID theft as you can be.
Doesn't change the fact that you expected a soft pull (based on assurances from a rep) and instead a hard one was done. And in that you'll have everyone's sympathy. That sucks. And the lessons learned (that I mention above) are truly lessons: many of us think that if we don't give our SSN then a hard pull can't be done. You have a lot of company there.
Anyway, to summarize, this will likely have no effect on your life and the creditor is doing everything he can to fix it on top of that. Relax, make some good food, go for a walk, watch a movie, etc.
