Black Hat

A Black Hat is an attacker who breaks into other people’s computers, networks, or accounts without permission. Their goal is personal gain: money, stolen data, or simply destruction. The name comes from old western films, in which the villains wore black hats and the heroes wore white ones. Following this imagery, professionals who search for security vulnerabilities with explicit permission are called White Hats. In between are the Grey Hats, who search without being asked but report their findings instead of exploiting them. What matters for this classification is not the technique but the intent and the permission.

What attacks cost and who they affect

Black Hats have long since stopped being lone individuals working from their bedrooms. A large share now work in organized groups with a clear division of labor. Some write the malware, others resell it, and still others launder the stolen money. There are even offerings modeled on software subscriptions: anyone who cannot program themselves can rent ready-made ransomware and share the loot with the developers.

The consequences affect more than just large corporations. In Germany, hospitals have already been paralyzed, forcing emergency rooms to turn away patients. City administrations, too, have come to a standstill for weeks because their data was encrypted. For companies, the stakes are production outages, fines, and lost trust. Worldwide damage from cybercrime is estimated at several trillion euros per year.

This is precisely why the counterpart term is so important. Companies pay White Hats to attack their own systems before someone else does. Such commissioned attacks are called penetration tests. Many companies also pay rewards for reported security vulnerabilities, known as bug bounties. A discovered flaw costs a few thousand euros there, while an exploited flaw quickly costs millions.

Typical tools and routes of intrusion

The most common route into a system is not through technology but through people. In phishing, the attacker sends an email that looks like it came from the bank or from the boss. Anyone who enters their password in response has handed over the key themselves. Such tricks, which rely on trust and time pressure, are summarized under the term social engineering.

The second route is programming errors in software. Almost every larger program contains gaps through which foreign code can be smuggled in. Zero-day vulnerabilities are especially valuable: flaws that the manufacturer does not yet know about and for which there is consequently no update. Such vulnerabilities are traded on illegal marketplaces for six-figure sums. Once the attacker is inside, they usually install a backdoor for later access.

Artificial intelligence has changed both routes. Language models write flawless phishing emails in any language, which devalues the old warning sign of clumsy phrasing. Fake computer-generated voices, known as deepfakes, have already tricked employees into making million-euro transfers. Conversely, defenders use the same technology to detect suspicious patterns in network traffic earlier.

The term in headlines and in everyday life

In the news, the term usually appears after a major data breach. It is then reported that Black Hat hackers stole millions of customer records. Confusingly, the world’s most famous security conference is also called Black Hat. There, defenders gather annually in Las Vegas of all places to demonstrate new attack methods. The name was chosen deliberately as a provocation.

Outside of IT security, there is the term Black Hat SEO. This refers to tricks used to unfairly push a website higher in Google's search results. This is not illegal, but it violates the search engines' rules and leads to exclusion. The choice of words follows the same logic: permitted methods are considered White Hat.

A common misconception is that hackers are automatically criminals. Originally, the word referred only to someone who creatively repurposed technology. It is only the addition of Black Hat that turns this into an attacker. This topic becomes practically relevant for everyone in the context of passwords and updates. Two-factor authentication and promptly installed security updates prevent the vast majority of all attacks on private individuals.