It's only considered an asset because companies are allowed to externalize the cost of breaches.

https://www.youtube.com/watch?v=CS9ptA3Ya9E (Mitchell and Webb on "identity theft")