Cybercriminals set sites on identities