According to the FTC, it only takes “nine minutes” for identity theft criminals to begin using stolen data.

“The research shows that Identity thieves are actively looking for any consumer credentials they can find: if your account data becomes public, they will use it.”

They concluded that leveraging two-factor authentication, anytime that you can, is a best practice that everyone should employ. Read more on their experiment with hackers, here:

Preventing and Responding to Identity Theft:
Choosing and Protecting Passwords:
Supplementing Passwords (like using two-factor):