Under 18 USC sec 1030(a)(5)(B)(i), a person subject to an identity theft associated with a computer system that causes more than an aggregate loss of $5,000 during any one-year period, has a private right of action against the purpetrator.
Unfortunately, there is no right to punitive damages under the law -- only recovery of the lost money is permitted.
You could sue for the common law tort of "misappropriation of identity," but as you have already recovered your money, your right to punitive damages, in the absence of any compensatory damages, could be quite limited. But, you could try it in small claims court and ask for the jurisdictional maximum. Maybe the judge would award punitive damages, despite your having only nominal general damages.
Hope this helps.
Terms and Conditions: By your continuing in this conversation with me, or by your clicking “Accept”, you are expressly agreeing to all of the following: (1) our communication is for entertainment purposes only; (2) you are not consulting me in my professional capacity as an attorney; (3) you do not seek to establish an attorney-client relationship with me, nor do I with you; (4) you will not rely on anything I say and you will obtain appropriate legal counsel via a traditional/office consultation with an attorney licensed to practice in the jurisdiction where your legal issue arises (and you may not use our communication to avoid taxpayer penalties imposed by the U.S. Dept. of Treasury); (5) by communicating with me in this public forum you are irrevocably waiving any right to privacy, confidentiality and attorney-client privilege concerning the matters discussed. You further separately declare that any payment made by you is not consideration for this contract, nor offered for any services rendered by me on your behalf, but rather is made in genuine admiration and respect for my desire to help others. If you do not agree with these terms and conditions, then you must advise me immediately.