There have been instances in which a system operator, believing he or she is locking the intruder out for good, expends a great deal of time and effort to completely rebuild the network using backup media, only to find that the exploit was present in the backup and was simply reintroduced. Of course, a victim could initiate its own investigation to find the intruder. If successful, the victim may be able to initiate a civil suit for damages. Further, a monetary award is unlikely to serve as the same deterrent as a jail sentence or even probation. The general deterrence that criminal law enforcement provides also benefits victims and potential victims in the long run.
Restitution is also an attractive motive for victim reporting.
Being a victim of intrusion is almost always an expensive proposition. A responsible victim must survey the system to determine whether any data was taken or damaged, and if so must repair the damage. The victim must analyze the network to determine if there are any remaining holes in the system, check the integrity of the logs, identify the means by which the intruder accessed the system, and patch the vulnerability. The costs can be very high, and can grow when the victim includes the loss of business and the lost productivity of the technical staff dedicated to the intrusion. The victim may be able to recoup some or all of the expenses through restitution.