How cybercriminals used stolen student identities