According to examples, an apparatus may include a processor and a computer readable medium on which is stored machine readable instructions that may cause the processor to assign the activities in user activity data into a plurality of groups based on common user identifiers corresponding to the pairs of activities. The instructions may also cause the processor to determine a correlation between a user event and the plurality of groups, determine whether the user event is suspicious based on the determined correlation, and based on a determination that the user event is suspicious, output an indication that the user event is suspicious.