You personally don't have to be "online" in any form to have your identity stolen.
That statement is true because your information is already there, in databases, forms, lists. Hackers do not steal identities from individuals directly they steal them from hacked lists that are sold on the black market.
I'm not in the online security business, but I do help folks with securing PC's, networks, what-have-you on a personal level.
At this point in the game, the best thing you can do is to be "proactive" by being "reactive" with the big three credit bureaus as well as Fair Isaac (FICO). Check these at the very least, quarterly, and dispute directly with each any information that is not accurate.
Use cash, and NEVER use your debit card as a Credit Card... ever. Always insist they swipe it as a debit transaction. Which even then, they may still.... but that's OK, because you're checking your credit reports, remember.