It's actually quite common. The typical series of events is something like:

- criminal steals someone's SSN

- criminal uses that SSN to steal an identity

- the SSN owner notices their identity has been stolen and reports it to authorities

- the authorities investigate and are able to trace it back to where it was stolen from (and sometimes even who stole it)

- the authorities notify the company that was breached.

It's more common with larger breaches with more stolen SSNs (and thus more people reporting that their SSN was stolen) because that catches the FBI's attention more readily and makes it easier to trace it back.

txcwpalpha mentions one common path. It is also a pretty standard practice for law enforcement to perform forensics on seized C2 components (sometimes even replacing them with emulators or continuing to operate them for some time in order to collect additional data), so that they can identify and notify victims.