Hacking is using a computer or network in a way the owner did not intend

Hacking in computing means gaining unauthorized access to a computer, network, or software system, or using a system in ways the owner did not permit. A hacker is someone who does this. The term covers everything from stealing passwords to install malware, to breaking into a server to read private files, to finding and exploiting a flaw in software code that lets an attacker do something the programmer never meant to allow.

Not all hacking is criminal. Security researchers and software companies employ hackers—called ethical hackers or penetration testers—to find weaknesses in systems before criminals do. But when someone hacks without permission, it is illegal in most countries, including the United States under the Computer Fraud and Abuse Act.

Key Takeaways

  • Hacking means accessing a computer or network without permission, or using one in ways the owner did not allow.
  • Criminal hacking includes stealing passwords, installing malware, reading private files, and exploiting software flaws to cause harm.
  • Ethical hackers work for companies and security firms to find weaknesses in systems before criminals exploit them.
  • Common hacking methods include phishing emails, weak password guessing, unpatched software vulnerabilities, and social engineering.
  • Protecting yourself involves using strong passwords, keeping software updated, recognizing suspicious emails, and enabling two-factor authentication.

How hackers gain access to systems

Hackers use several common methods to break into computers and networks. Phishing is sending fake emails that look like they come from a trusted source—your bank, your employer, a service you use—to trick you into clicking a link or opening an attachment that installs malware or steals your login information. The email might say your account has been compromised and ask you to "verify" your password on a fake website that looks real.

Another method is password guessing. If your password is straightforward—like "password123" or your birth year—a hacker can try thousands of combinations in seconds using automated tools. Weak passwords on shared accounts or default passwords that come with new devices are especially vulnerable.

Unpatched software is software that has a known security flaw but has not been updated to fix it. Hackers scan the internet for computers running outdated versions and exploit the flaw to gain entry. This is why your operating system and applications constantly ask you to install updates.

Social engineering means manipulating someone into revealing secrets or performing actions that compromise security. A hacker might call pretending to be IT support and ask you to confirm your password, or send a message claiming to be from your company's finance department asking you to wire money urgently.

What hackers do once they are inside

Once a hacker has access to a system, their goals vary. Some steal personal information—credit card numbers, Social Security numbers, medical records—to commit identity theft or sell on the dark web. Others install ransomware, which encrypts your files and demands payment to unlock them. Some plant spyware that watches everything you type and do, or trojans that appear to be legitimate programs but secretly perform harmful actions.

Hackers may also use your computer as part of a botnet—a network of infected machines controlled remotely—to launch attacks on other targets without the owner knowing. They might alter files, delete data, or use your email account to send spam or phishing messages to your contacts, making it look like the messages came from you.

In corporate settings, hackers may steal trade secrets, customer databases, or financial information. In government or critical infrastructure, the goal might be to disrupt services, steal classified information, or cause physical damage through systems that control power grids, water treatment, or hospitals.

The difference between hackers, crackers, and script kiddies

The term "hacker" originally meant someone skilled at programming and problem-solving—not necessarily someone breaking into systems. Some people use cracker to describe someone who breaks into systems for criminal purposes, while reserving "hacker" for skilled programmers or ethical security researchers. However, in everyday language, "hacker" now usually means someone breaking in without permission.

Script kiddies are people with little technical skill who use tools and code written by others to launch attacks. They read a hacking tool from the internet and run it without understanding how it works. They cause real damage but lack the knowledge to create new exploits or adapt when defenses change.

Ethical hackers and penetration testers are hired by organizations to find vulnerabilities. They have permission in writing, work within defined boundaries, and report findings to help the organization fix problems before criminals find them.

Common types of hacking attacks

Brute force attacks involve trying many password combinations rapidly until one works. A tool might try "aaa", "aab", "aac" and so on until it finds the right password. This works on weak passwords but takes impractically long on strong ones.

Man-in-the-middle attacks happen when a hacker intercepts communication between two parties. If you connect to an unsecured public Wi-Fi network, a hacker on the same network might intercept your login credentials or financial information as it travels between your device and the website.

SQL injection is inserting malicious code into a website's search box or login form to trick the underlying database into revealing information or performing unintended actions. A hacker might type code instead of a search term, and if the website is not properly protected, the code executes.

Distributed denial-of-service (DDoS) attacks flood a website or service with so much traffic from many sources that it becomes overwhelmed and stops working. Hackers often use botnets to generate this traffic.

Why hacking happens and who does it

Hackers have different motivations. Cybercriminals hack for money—stealing financial information, demanding ransom, or selling stolen data. Hacktivists hack to make a political or social statement, often targeting government or corporate websites. Nation-state hackers work for governments to spy on other countries, steal secrets, or disrupt infrastructure. Insider threats are employees or contractors with legitimate access who abuse it for personal gain or revenge.

Some people hack out of curiosity or to prove their skills, though this is still illegal without permission. Others are coerced—criminals threaten them or their families to force them to participate in attacks.

How to reduce your risk of being hacked

Use strong passwords that are at least 12 characters long and mix uppercase, lowercase, numbers, and symbols. Avoid words from the dictionary, your name, or information publicly available about you. A password manager like Bitwarden or 1Password can generate and store strong passwords so you do not have to remember them.

Enable two-factor authentication (2FA) on important accounts—email, banking, social media. This means even if someone steals your password, they cannot log in without a second form of proof, usually a code from an app on your phone or a text message.

Keep your operating system, browser, and software updated. Turn on automatic updates so you do not have to remember. Updates patch security flaws that hackers actively exploit.

Be suspicious of emails asking you to click links or read files, especially if they create urgency or ask for passwords. Hover over links to see the real URL before clicking. If an email claims to be from your bank or a service you use, go directly to the website by typing the address yourself rather than clicking the email link.

Use a VPN (virtual private network) when connecting to public Wi-Fi to encrypt your traffic so others on the network cannot intercept it. Avoid logging into sensitive accounts on public Wi-Fi without a VPN.

Frequently Asked Questions

Is all hacking illegal?

No. Ethical hackers hired by companies to test security are legal. Hacking without permission is illegal in most countries. The Computer Fraud and Abuse Act in the United States makes unauthorized access a federal crime, with penalties including fines and prison time.

Can hackers see what I type on my keyboard?

Yes, if they install keylogging malware on your device, they can record every keystroke—passwords, messages, search terms. This is why keeping your software updated and running antivirus scans matters. A VPN does not protect against keyloggers on your own device, but it does prevent others on your network from seeing your traffic.

What should I do if I think I have been hacked?

Change your passwords when ready from a different device if possible. Enable two-factor authentication on important accounts. Check your bank and credit card statements for unauthorized charges. Consider placing a fraud alert with the credit bureaus. Run antivirus and antimalware scans. If sensitive information was stolen, monitor your credit report and consider identity theft protection services.

Why do hackers target individuals instead of just big companies?

Individuals are often easier targets because they have weaker security than companies. Hackers may steal your identity, use your computer in a botnet, or hold your files for ransom. Even small amounts of money from many people add up. Individuals are also stepping stones—hackers break into personal email accounts to gain access to employer networks.

Can I learn hacking to protect myself?

Yes. Many universities and online platforms offer courses in cybersecurity and ethical hacking. Learning how systems work and how to find vulnerabilities is valuable for defensive work. However, using those skills to access systems without permission remains illegal, even if you do it to "test" someone else's security.