A licensing platform compromise shows how a third-party service can turn routine government transactions into a large identity-security event.