Passwords that might be similar to other services and then try to access those services as well.

And also all the metadata associated to user's activity