thank you so much, yes, I know, the third-party company is quite fishy, fortunately, they only know my name and address, not SSN. They used my personal name as the legal entity's name (which is ridiculous...), I only found out about all this after the EIN was assigned, so I'm also very angry with my friend.
I've always been careful with my SSN, but I didn't know that someone could apply for an EIN with my name just using my name and address.
