Got a "business debit" card in the mail from Square that we didn't request

A "business debit" card that we didn't request showed up in the mail from Square in my wife's maiden name with a fake business name (like "Jill's Bakery"). We called Square and they're closing the account.

We did the free annual credit report and don't see anything unusual. My guess is some scammer opened a Square account using her name/address to use it to extract money from stolen credit cards. So far we don't know if they had her social security number or anything like that.

Anything else we should be concerned with?