The person who owns the identity can be attacked all the way down to the accounts and programmes they use. An identity attack vector can affect the person who owns the identity or any other link in the chain, including the applications, accounts, passwords, and privileges they use.