Unfortunately what you experienced is more common than it should be.

To add to the disappointment, you pretty much have no realistic recourse with respect to punitive actions against the employer.

You'd have to have provable damages as a result from this practice. And obviously, that's going to be difficult as stolen information can be set aside for years before being sold and acted upon. By then, who knows how your information was stolen. Could have been through the see-through envelope. Could have been any number of other breaches.

Anyways, you should act as if your identity has been stolen. Even if this event didn't happen, you should act as if your identity has been stolen. As in, follow the Identity Theft guide in the PF Wiki. Freeze your credit at all the various credit bureaus. Again, should be done regardless of whether or not this event occurred.