To combat evolving identity theft threats, policymakers must enforce stronger data security standards and hold negligent data handlers accountable.