Identity theft now drives much of the UK's cyber threat landscape, with criminals exploiting phishing, data breaches and weak passwords to steal personal and business identities.