A Day in the Life of a Cybercriminal

A Day in the Life of a Cybercriminal

A digital identity report on how broader context can reveal hidden risk

A digital identity report on how broader context can reveal hidden riskContents

See how digital identity intelligence helps provide context for security decisions

One Day. Many Stops.

Before you see me, I’ve already been busy.

When you start your workday, I start mine too. I don't limit myself to a single organization or industry. Throughout the day, I move across accounts, websites and digital services, generating activity that extends well beyond healthcare.

A patient portal account creation isn’t always my first stop. Before I appear in a healthcare provider organization, I may have already generated activity across retail, financial services, insurance and countless other digital interactions.

You see an account creation request, but you don’t see what came before it.

Every healthcare provider

organization sees a single interaction

The cybercriminal leaves a much larger trail

8:00 a.m.
Banking login attempts begin.

10:00 a.m.
Banking attempted money
transfer activity appears.

Noon
A healthcare password reset occurs. Appears routine to the organization.

2:00 p.m.
An insurance account creation request is submitted. Nothing unusual detected.

4:00 p.m.
A healthcare password recovery request follows. Appears routine as well.

6:00 p.m.
Retail activity begins.
On to the next opportunity.

From Fiction to Reality

Though the journey above has some fictional elements, it illustrates a real-world pattern.

Our data shows that a single device can be associated with activity across multiple organizations and industries. Some of those transactions have been linked to confirmed fraud events.

In this example, a healthcare organization was just the device's latest stop:

HOW ARE CYBERCRIMINALS SUCCESSFUL?

The account creation request appears routine. Nothing immediately stands out to you about the interaction.
If you evaluated the interaction by itself, there would be little reason to suspect elevated risk.

How Many are Too Many?

One device in this analysis was associated with:

2,736 transactions
10 event types
25 organizations
4 industries
And linked to 247
confirmed fraud events

Is 247 a lot?

How many fraud events would it take to get your attention?

THE ANSWER SHOULD BE ONE

For healthcare provider organizations, one confirmed fraud event can expose a security gap, trigger an investigation or result in harm to patients or operations.

The real question you should be asking yourself is whether knowledge of prior confirmed fraud activity would influence how you make a security decision.

Would a login be evaluated differently?

Would an account creation request warrant additional scrutiny?

Would a password reset request be treated with greater caution?

This is where broader digital identity intelligence creates value. Prior device, identity and fraud activity can reveal potential risk that may not be visible when evaluating a single interaction in isolation.

The Multiplication Problem

Everyone would agree one fraud event is too many.

The Multiplication Problem

Everyone would agree one fraud event is too many.

THAT'S THE THREAT MULTIPLIER. BUT IT ALSO CREATES AN OPPORTUNITY.

The same activity that expands the threat can help build a broader picture of risk, giving you access to information that may not be visible within a single interaction alone. What creates the challenge reveals the risk.

What Creates the Challenge Reveals the Risk

Digital identity intelligence can help you identify potential risk that might otherwise remain unseen during patient portal account creation, password recovery and other digital interactions.

The Challenge for Healthcare Provider Organizations

Every account creation request. Every password reset. Every interaction requires you to determine whether access should be allowed, challenged or reviewed.

Does the behavior align
with normal activity?

Is the individual likely to
be who they claim to be?

Does the device appear familiar?

Should you require additional
identity proofing?

For healthcare provider organizations, these decisions are happening at enormous scale. As hospitals and health systems expand patient portals, online account recovery, self-service tools and digital engagement programs, the volume of digital interactions continues to grow.

13.8M+ Healthcare Interactions Tied to Confirmed Fraud

Healthcare interactions confirmed to a device elsewhere in the Digital Identity Network.

This means activity associated with a healthcare interaction has been linked to confirmed fraud identified by another organization, whether inside or outside healthcare.

Risk Signals Observed Across Healthcare Transactions

The healthcare data also shows the volume of risk signals that may appear across digital identity interactions.

In 2025, healthcare transactions included these risk signals:

Risk Can Look Legitimate

Activity associated with fraud in one organization or industry may later appear in a healthcare interaction.

Strength in Numbers

If you have the data, you can leverage prior digital online activity to better assess risk for each patient portal login or account recovery. The more data points you have, the more confidently you can identify potential risk when evaluating patient portal account creation requests, password resets and other digital interactions.

Billions of digital interactions, devices, identities and transactions analyzed.

One global identity intelligence network. The LexisNexis^® Digital Identity Network^® helps identify trusted and potentially risky activity.

By connecting insights from transactions, the network helps organizations make more informed security decisions.

AT A GLANCE

Global LexisNexis^®Digital Identity Network^®

What Starts Elsewhere Doesn’t Stay Elsewhere

Cybercriminals don’t operate within a single organization or industry.

The same device, identities and tactics can appear across:

Financial
services

Retail

Insurance

Healthcare

Activity observed elsewhere may eventually surface in your environment, even when nothing about the interaction immediately stands out. That’s why visibility beyond your healthcare organization matters. Signals observed across billions of digital transactions may provide context that isn't available from the interaction alone.

VISIBILITY BEYOND
YOUR HEALTHCARE
ORGANIZATION MATTERS

See how digital identity intelligence helps provide context for security decisions

About the Data: This ebook contains digital transaction information gathered from the Digital Identity Network taken from two sources:

LexisNexis^® Risk Solutions. The Evolving Threats Beneath the Surface. 2026. https://risk.lexisnexis.com/insights-resources/research/cybercrime-report
Internal data analysis conducted by LexisNexis^® Risk Solutions based on data available as of 2025. Findings and conclusions reflect conditions known at that time and may not reflect subsequent developments, updated information or current market conditions.

_{About LexisNexis® Risk Solutions}_{LexisNexis® Risk Solutions provides customers with information-based analytics and decision tools that combine public and industry-specific content with advanced technology and algorithms to assist them in evaluating and predicting risk and enhancing operational efficiency. Headquartered in metro Atlanta, Georgia, the company has offices throughout the world, serves customers in more than 190 countries and territories and is part of RELX. For more information, please visit LexisNexis Risk Solutions. LexisNexis and the Knowledge Burst logo are registered trademarks of RELX Inc. Digital Identity Network and ThreatMetrix are registered trademarks of ThreatMetrix, Inc.}
_{Copyright© 2026 LexisNexis Risk Solutions. NXR17164-00-1026-EN-US}