Identity theft linked to major data broker breaches has cost Americans more than $20 billion over the past decade, according to a U.S. Senate report.