You may have done this already, but I'd put an extended fraud alert (the 7-year one) with all the credit reporting bureaus and possibly even a freeze/lock at each. And check with each to be sure there have been no other credit applications in your name. You may want a credit-monitoring service to watch for any future events.
It also can't hurt to file a police report, but there is so much ID theft and Internet crime, that police offices often give it short shrift and may not do much to investigate other than tell you to report it to IRS, SBA OIG, FTC, credit bureaus, etc. But you'll have evidence that you reported it.
Also you can report to the FTC online. And the FTC report that you can print out can be used as one of the items to submit to the credit bureaus for an extended fraud alert.
