Tens of thousands of Americans are now at risk of identity theft and fraud after a major hack at a US mortgage firm.