I just assume most people who have a normal online presence have had some form of identity leaked, as well as plenty of people that don’t. Like maybe elderly have credit records breached when Experian got hacked.
Gotta have 2FA, and make sure critical accounts have solid passwords. About all you can do, and no guarantee some shoddy IT in the business holding the account didn’t store all your info unhashed or something.