Well, targets are also victims to some degree, but I get your gist. I would take it a step further: for identity theft the company that fails to verify your identity before reporting false info to a credit agency is at fault - for libel with damages. My SSN is not a form of authentication and using it as such should be a crime.