Why would those pieces of data (DOB, full name, address) ever be sufficient for identity theft?

If that's sufficient to achieve anything then those systems are built on top of hopes and dreams.

It's good enough for health insurance fraud.

Edit: does someone not realize that many (all?) the doctors and hospitals use to verify you is your name and date of birth (in the U.S. - although I suppose that's why since this breach happened elsewhere)?

Because the world is run by people who don't know anything, but have to pretend they know everything, so they can't ask those of us who have some idea about how IT security works.