While I agree it is private information, its simply not true that "The information stolen is more than sufficient to commit identity theft and credit card fraud. I could probably sign-up for a credit card in your name with less actually."
Name, birthdate, and probably gender. Different address for obvious reasons. What else would you need really? Legally no one can require you to provide a SSN which means some credit card company will offer you one without that info. Alternatively you can simply fake one as they never get actually verified. I suspect there isn't actually a way to verify them easily based on my experience dealing with a state registry. What else would you need?
Yes they do verify the other proof of identity (and they dont accept all of them), at least here in Canada. The data can serve for phishing though. If you think about it, the information stolen is very easy to get on anyone you barely know. I hope they do verify proof of identity in the states too.
Between, I deal with credit agencies almost everyday.