With the REAL ID Act of 2005, they instituted a de facto national identity system by mandating that records be centralized and state-issued IDs be brought up to a common standard.
The volume of traffic between Yahoo's back end admin system and the wider internet during the attack strongly suggested that a file of 22 million IDs had been stolen.