Credit monitoring is a waste
We need to come up with laws to properly punish companies for "losing" employee or customer data. Credit monitoring will do literally nothing to restore the credit of those who become victims of identity theft. Nor will it give them back the time and money they have to give to clean up the situation. And since you're given a social security number at birth and keep it for life (much like biometrics), there's really nothing you can do to prevent the same ID thief from assuming your identity again once you restore your credit (assuming the credit bureaus will even talk to you and help/allow you to restore your credit in the first place). Since you can't change your social security number or your date of birth, the only thing you might be able to do is legally change your name, and then deal with all the hassles that causes. All because a large for-profit company didn't care enough about protecting the information it stored about you.
Credit monitoring is just as useful as on-demand antivirus with no realtime component. Sure, it'll tell you once you become a victim, but it won't prevent it from happening. What we need is something to prevent ID theft in the first place. And using information that cannot be changed when (not if, but when) it is compromised, such as biometrics, is not the answer.