Point of order: the victims of the attack are the million or so people reading about it in the news.
The targets of the attack are doing their level best to control the narrative by spinning their attackers as extremely sophisticated so they don’t end up with a million or so people holding torches and pitchforks outside their offices.
Well, targets are also victims to some degree, but I get your gist. I would take it a step further: for identity theft the company that fails to verify your identity before reporting false info to a credit agency is at fault - for libel with damages. My SSN is not a form of authentication and using it as such should be a crime.
The targets of the attack are doing their level best to control the narrative by spinning their attackers as extremely sophisticated so they don’t end up with a million or so people holding torches and pitchforks outside their offices.