There are several ways Identities are stolen, I would try my best to itemize a few and possible ways to curtail/prevent them
You are right, hackers and criminals have so many attack vectors, to make victims online from hacking and stealing personal data such like KYC. We have very huge inconvenieces to take to stay safe online against hackers and criminals.
The moment you submit your data online to pass any form of KYC you have already risked it or will I just say you have exchanged your privacy for what ever reason you submitted it for it should be worth it before we think about submitting our document online for any form of verification, sometimes it’s not just data bridging that expose our data but some insiders who work with the service can be the ones to sell off users data we have had about such cases in the past and it’s very common where their is monetary benefit attached to it.
Anyone who must remain in the space for long should avoid how they give out their personal information especially to gambling and to exchange as I believe it's these two platforms that often asked for documentation, but what more and what would their user do after reading the terms and condition binding their operations between the casino or exchange to their users they wouldn't have any options than to accept in other for them to continue using that site.