Everyone is vulnerable when it comes to identity theft, but the OP’s position, should they notify anyone, is a lose-lose one regardless.
Morally they should “do the right thing”, but as many have explained in the comments, this will end up costing anything from reputation to money to freedom.
It really sucks that the only sane advice here is to sit on it and move on :(