Passwords should change, and besides notifying the credit reporting agencies, I would also notify any financial institution you deal with, and the postal inspectors.

Mail and wire fraud is their bailiwick.