Few breaches lead to identity theft, GAO finds