The framing of "identity theft" is an attempt to shift blame.

Why not call it "data protection failure?"

If you leave your valuables in a cardboard box on the street you can't call it "theft" when someone takes them.