Friend just got his ID majorly stolen -- someone is using his SSN, current address, DOB, etc to open new credit card accounts. About $5,000 so far.

About four days ago he signed up for a new health plan via an exchange. He can't remember anytime before that where he used his SSN. Worried there may be data leaks; after all, these exchanges just take all your personal info and send it to a private insurer.