A black hat hacker is a person who breaks into computer systems and networks without permission for personal gain, malicious intent or to cause damage.
What black hat hackers do
The name comes from old Western films, where villains wore black hats and heroes wore white ones. Unlike white hat hackers, who test security with authorisation, black hats act illegally. Their activities include:
- stealing and selling data, credentials and payment cards;
- deploying ransomware and extorting victims;
- developing and selling malware, exploits and access to compromised networks;
- running botnets, phishing campaigns and fraud schemes;
- espionage or sabotage on behalf of governments.
Between the two sits the grey hat: someone who breaks into systems without permission but without malicious intent, for example to report a flaw afterwards – which is still illegal in many countries.
Why black hat hackers matter
Black hat activity is the core of cybercrime, which has become an industry with specialised roles: initial access brokers, malware developers, ransomware affiliates and money launderers. Skill levels range from script kiddies to highly professional teams. Some former black hats changed sides: Kevin Mitnick, once one of the FBI’s most wanted hackers, later ran a security consultancy.
Laws such as the US Computer Fraud and Abuse Act (1986), the UK Computer Misuse Act (1990) and the Council of Europe’s Budapest Convention on Cybercrime (2001) criminalise unauthorised access and related offences.
How organisations defend
- Patch systems and reduce the attack surface exposed to the internet.
- Use MFA, least privilege and network segmentation.
- Monitor for intrusions and prepare an incident response plan.
- Invite white hats to find flaws first through penetration tests and bug bounties.
