According to the FTC, it only takes “nine minutes” for identity theft criminals to begin using stolen data.

“The research shows that Identity thieves are actively looking for any consumer credentials they can find: if your account data becomes public, they will use it.”

They concluded that leveraging two-factor authentication, anytime that you can, is a best practice that everyone should employ. Read more on their experiment with hackers, here: https://www.consumer.ftc.gov/blog/how-fast-will-identity-thieves-use-stolen-info

Preventing and Responding to Identity Theft: https://www.us-cert.gov/ncas/tips/ST05-019
Choosing and Protecting Passwords: https://www.us-cert.gov/ncas/tips/ST04-002
Supplementing Passwords (like using two-factor): https://www.us-cert.gov/ncas/tips/ST05-012