What is hacking? How hackers break in, and why

Hacking is getting a computer system to do something its owners or designers never intended. In everyday news it means breaking into computers, accounts or networks without permission. In its older sense it means clever tinkering, and many hackers are paid to break in so that criminals can't. Most real break-ins are less cinematic than films suggest: a tricked person, a reused password or software nobody updated.

In short

• "Hacker" has two meanings: a skilled tinkerer, and someone who breaks into systems. Permission is what separates legal hacking from crime.
• Most attacks come through three doors: people, passwords and unpatched software.
• A handful of habits, such as unique passwords, two-step sign-in and updates, block the bulk of everyday attacks.

What does "hacker" actually mean?

The word started as praise. At the Massachusetts Institute of Technology in the late 1950s, members of the Tech Model Railroad Club used "hack" for an ingenious, often playful piece of work, and the club's dictionary, first compiled in 1959, recorded the slang. When those students moved on to MIT's early computers, a hacker became someone who loved making a machine do more than its manual said. That sense survives among programmers: a "hackathon" is a contest to build things, not to break them.

The second meaning took over in the 1980s. As home computers and modems spread, break-ins made headlines, and the 1983 film WarGames, about a teenager who nearly starts a nuclear war from his bedroom, brought the idea to a mass audience. Some programmers pushed back by calling malicious intruders "crackers" instead, but the usage debate never really ended, partly because lawful and unlawful hacking use the same techniques. What separates them is permission.

How do hackers break in?

Almost every break-in goes through one of three doors. This note describes them at the level a defender needs, not as instructions.

People. The cheapest way into a system is to ask someone inside to open it. Phishing messages pose as a bank, a boss or a delivery company and get a person to type a password into a fake page, approve a sign-in, or open a file that installs malicious software. This is called social engineering: attacking the person rather than the machine.

Passwords. People reuse passwords, and every large data leak puts millions of email-and-password pairs on sale, often on the dark web. Attackers feed those lists into automated tools that try them on other sites, an attack called credential stuffing. A password used on one leaked site is, in effect, leaked everywhere it was reused.

Unpatched software. All software has flaws. When a flaw that lets outsiders in is found, the maker publishes a fix, a patch, and the race begins between defenders installing it and attackers using it. Verizon's 2026 Data Breach Investigations Report, which studies thousands of confirmed breaches a year, found that 31% of breaches started with software vulnerabilities, overtaking stolen passwords as the most common way in.

One breach, step by step

The Equifax breach shows how ordinary the cause can be. According to the Federal Trade Commission, the US credit bureau went through it like this:

When	What happened
March 2017	Equifax is alerted to a critical flaw in software behind a database that handles consumer credit inquiries. Its security team orders the patch applied within 48 hours, but no one checks that it was.
The months after	Attackers find the unpatched system and stay inside the network, undetected for months, taking personal data.
July 2017	Equifax's security team notices suspicious traffic and finds the unpatched database.
Later in 2017	The breach turns out to have exposed data on about 147 million people, including Social Security numbers.
22 July 2019	Equifax agrees to pay at least $575 million, and potentially up to $700 million, to settle with US regulators and states.

No genius was required. A known flaw, a fix that existed, and a step no one confirmed.

Why do people hack?

The motive is usually money. Criminal groups steal data to sell, take over accounts to drain them, or use ransomware, software that locks an organization's files until it pays. Verizon's 2026 report found ransomware in 48% of the breaches it studied. Governments hack too, to spy on one another and sometimes to sabotage. Activists, sometimes called hacktivists, deface sites or leak documents to make a point. And some people still hack out of curiosity or for a reputation among peers.

On the other side are hackers paid to attack with permission: penetration testers hired to find a company's weak spots before criminals do, and researchers who report flaws to software makers, often for a reward through a bug bounty program.

White hat, black hat, grey hat: what's the difference?

The security world borrows the hats from old westerns, where the hero wore white and the villain black.

	White hat	Grey hat	Black hat
Has permission?	Yes, in writing	No	No
Intent	Find and fix weaknesses	Often to expose or report a flaw	Theft, damage, spying or profit
Typical work	Penetration tests, bug bounties, security research	Probing systems uninvited, then telling the owner	Ransomware, account takeover, data theft
Legal?	Yes	Usually not, even with good intent	No

The law draws the line at access without authorization. In the United States the main law is the Computer Fraud and Abuse Act of 1986; in the United Kingdom it is the Computer Misuse Act 1990. Good intentions don't count as permission, which is why grey-hat work can still end in court.

Which habits block most attacks?

The common misconception is "nobody would bother hacking me". Most attacks aren't aimed at anyone in particular: automated tools try leaked passwords and scan for unpatched devices across the whole internet, and they find ordinary people because ordinary people are most of the targets. The good news is that the same few habits shut all three doors. The UK's National Cyber Security Centre puts these near the top of its advice:

• Use a different password for every account, especially email, since email resets every other password. A password manager remembers them.
• Turn on two-step verification (also called multi-factor authentication), so a stolen password alone isn't enough. Microsoft reported in 2019 that it can block over 99.9% of account compromise attacks.
• Install updates promptly on phones, computers and routers. Most updates fix security flaws, and Equifax shows what one missed patch can cost.
• Treat unexpected messages as suspect, however urgent, and check through a route you already trust before clicking, paying or signing in.
• Back up what matters, so ransomware or a broken device can't take it away.

A VPN helps on untrusted networks but doesn't stop phishing or weak passwords. Understanding how computers work at all makes the rest of security easier to follow.

Check yourself

• Without looking back: what are the three doors most break-ins come through?
• Why does a password leaked from one site put other accounts at risk?
• What turns the same technique from security research into a crime?

Sources

• Hacker — Wikipedia
• 2026 Data Breach Investigations Report — Verizon, 2026
• Equifax to pay $575 million as part of settlement with FTC, CFPB, and states related to 2017 data breach — Federal Trade Commission, 2019
• One simple action you can take to prevent 99.9 percent of attacks on your accounts — Microsoft Security, 2019
• Top tips for staying secure online — National Cyber Security Centre, UK
• Computer Misuse Act 1990 — legislation.gov.uk, UK Government