Introduction Australia’s growing epidemic of identity crime has exposed a critical flaw in the nation’s cyber security response: the victims of data breaches are too often left to clean up the mess alone. As cyberattacks rise and personal information circulates through criminal networks, calls are mounting for a co-ordinated, government-led framework to replace today’s fragmented, victim-driven recovery model. At present, the responsibilities of organisations that suffer data breaches are minimal. Most are required only to notify affected individuals and regulators, leaving victims to navigate a confusing maze of credit bureaus, banks, government agencies, and online platforms. For many, restoring financial...