There are groups out there measuring the cost related to identity theft. The $56 billion number wasn't pulled out of thin air: https://javelinstrategy.com/content/2021-identity-fraud-repo...
How do propose liability could be demonstrated with something like this? Do you expect hackers and fraudsters to cite their sources when they are defrauding someone?