Each fact is a short, checked piece of hacking history. Press Another to read the next one.
The list runs from the first experimental worm in 1971 to the biggest cryptocurrency thefts of the 2020s, and takes in phone phreaks, hacker conferences, famous viruses and the hunt for the creators of Bitcoin and xz.
Facts about state-linked attacks say who governments and researchers have blamed. They do not claim a court has convicted anyone.
All the hacking facts
- In 1971 an experimental program called Creeper hopped between computers on ARPANET printing “I'M THE CREEPER: CATCH ME IF YOU CAN.” A second program, Reaper, was written to delete it.
- Before they started Apple, Steve Wozniak and Steve Jobs built and sold “blue boxes” — gadgets that made free long-distance phone calls by imitating the phone network's own tones.
- Elk Cloner, written in 1982 by a 15-year-old named Rich Skrenta, spread between Apple II computers on floppy disks and showed a short poem on the screen after the 50th start-up.
- In 1983 a group of Milwaukee teenagers who called themselves the 414s, after their area code, broke into dozens of computer systems, including one at Los Alamos National Laboratory.
- The 1983 film WarGames, about a teenager who nearly starts a nuclear war by dialling into a military computer, is widely credited with bringing hacking to the public's attention and feeding the push for the US Computer Fraud and Abuse Act of 1986.
- In 1984 Germany's Chaos Computer Club made a bank's videotex system charge it about 135,000 deutschmarks, then gave the money back the next day to prove how weak the system's security was.
- The first virus for IBM PCs, called Brain (1986), was written by two brothers in Lahore, Pakistan, and carried their shop's name, address and phone number.
- A 75-cent accounting error at a California research lab led astronomer Clifford Stoll to uncover hackers in West Germany who were selling secrets to the Soviet KGB. He wrote the story up as The Cuckoo's Egg.
- In a 1987 broadcast signal hijacking in Chicago, someone took over two TV stations for a few minutes, once with a person in a Max Headroom mask. The culprit was never identified.
- The 1988 Morris worm was meant to count computers on the internet, but a bug made it copy itself again and again and slowed many machines to a crawl. Its author, Robert Tappan Morris, became the first person convicted under the US Computer Fraud and Abuse Act.
- The first known ransomware, the AIDS Trojan of 1989, was mailed out on floppy disks and demanded $189 sent to a post office box in Panama.
- In 1990 hacker Kevin Poulsen took over the phone lines of a Los Angeles radio station so that he would be the 102nd caller in a giveaway, and won a Porsche.
- Kryptos, a sculpture outside CIA headquarters unveiled in 1990, carries four coded messages. The first three were cracked, but the fourth has resisted solving for decades.
- DEF CON, now the world's best-known hacker conference, began in Las Vegas in 1993 as a farewell party for a friend and drew about a hundred people.
- Kevin Mitnick, once the FBI's most-wanted hacker, got into most systems by tricking people rather than by technical wizardry — a method known as social engineering.
- Netscape ran one of the first bug bounty programs in 1995, offering rewards to anyone who found security flaws in its Navigator 2.0 beta.
- A mysterious stream of nonsense Usenet posts titled “Markovian Parallax Denigrate,” first seen in 1996, has never been fully explained.
- In 1998 members of the Boston hacker collective L0pht told a US Senate committee that they could take down the internet in about 30 minutes.
- The Melissa virus of 1999 emailed itself to the first 50 people in a victim's address book, forcing some companies to switch off their email systems.
- The ILOVEYOU worm of May 2000 spread through an email attachment disguised as a love letter and is estimated to have caused billions of dollars of damage.
- In February 2000 a 15-year-old in Canada using the name Mafiaboy flooded websites including Yahoo, CNN and eBay with traffic and briefly knocked them offline.
- In 2007 Estonia was hit by weeks of attacks that jammed government, bank and news websites, in what is often called the first major cyberattack on a whole country.
- In 2008 researcher Dan Kaminsky found a deep flaw in the internet's address book system, DNS, and quietly coordinated a fix across the industry before telling the public.
- In 2008, Anonymous began its first big campaign, Project Chanology, against the Church of Scientology after the church tried to remove a leaked video. It mixed online attacks with street protests where people wore Guy Fawkes masks.
- Bitcoin's first block, mined in January 2009, contains a newspaper headline: “The Times 03/Jan/2009 Chancellor on brink of second bailout for banks.”
- Stuxnet, discovered in 2010, damaged centrifuges in Iran's nuclear program by making them spin at the wrong speed while showing operators normal readings. It is widely believed to be a US-Israeli operation, but neither government has officially confirmed that.
- The hacking group LulzSec announced it was disbanding in 2011 after “50 days of lulz.” Its best-known member, Sabu, had been working with the FBI.
- In 2012 the Shamoon malware wiped data from about 30,000 computers at the oil company Saudi Aramco.
- The first message of the Cicada 3301 puzzle appeared online in January 2012, saying “We are looking for highly intelligent individuals.” Nobody has proven who was behind it.
- Hackers reached Target's payment systems in 2013 using stolen login details from one of its heating and air-conditioning contractors.
- Have I Been Pwned, a free service where you can check whether your email address appeared in a data breach, was launched by security researcher Troy Hunt in 2013.
- Heartbleed, a bug in the OpenSSL encryption library announced in April 2014, let attackers read pieces of a server's memory. It was one of the first security flaws to get its own name and logo.
- The 2014 attack on Sony Pictures leaked unreleased films and private emails. The FBI attributed it to North Korea, which denied involvement.
- In 2016 the Mirai botnet took over cameras and routers by trying factory-default passwords, then helped knock the DNS provider Dyn offline, disrupting sites such as Twitter and Netflix for many users.
- In 2016 thieves tried to move nearly $1 billion out of Bangladesh Bank's account at the New York Fed. A spelling mistake — “fundation” instead of “foundation” — got one request flagged, and about $81 million still went through.
- WannaCry ransomware hit more than 200,000 computers in over 150 countries in May 2017, including hospitals in England. A researcher, Marcus Hutchins, slowed it down by registering a web address that acted as a kill switch.
- The exploit behind WannaCry, EternalBlue, was leaked in 2017 by a group calling itself the Shadow Brokers, which claimed the tools came from a hacking group linked by researchers to the NSA.
- NotPetya spread worldwide in 2017 through a poisoned update to Ukrainian accounting software. The shipping giant Maersk said it cost about $300 million, and several governments blamed Russia's military.
- The 2017 Equifax breach exposed personal data of about 147 million people, after a known flaw in web software was left unpatched.
- In 2020 attackers hid malicious code inside a software update from SolarWinds that reached as many as 18,000 customers. The US government attributed the operation to Russia's foreign intelligence service.
- In July 2020 attackers took over high-profile Twitter accounts to run a bitcoin scam after tricking employees over the phone. A 17-year-old from Florida was charged as the organiser.
- In May 2021 ransomware forced Colonial Pipeline to shut its fuel lines. The company paid about $4.4 million, and the FBI later recovered roughly half of it.
- Log4Shell, a flaw in the widely used Java logging library Log4j disclosed in December 2021, was rated the maximum severity of 10 out of 10. The library was maintained largely by volunteers.
- In March 2024 a UK High Court judge ruled that Australian computer scientist Craig Wright, who had long claimed to be Satoshi Nakamoto, is not.
- The xz backdoor was spotted in March 2024 by Microsoft engineer Andres Freund, who noticed that SSH logins on his test machine were about half a second slower than they should be.
- The person or group using the name “Jia Tan” spent around two years earning the trust of the xz maintainers before hiding a backdoor in the software. Nobody has publicly identified them.
- The 2025 theft of about $1.5 billion in cryptocurrency from the exchange Bybit was blamed by the FBI on North Korean hackers. It is often described as the largest crypto theft on record.
- A toy whistle given away in boxes of Cap'n Crunch cereal produced a 2600 Hz tone that could trick old AT&T phone switches into giving free long-distance calls. The hacker magazine 2600 is named after that tone.
- The word “hacker” first described clever pranks and tinkering at MIT in the 1950s and 60s, including members of the Tech Model Railroad Club, long before it meant breaking into computers.
- The word “phishing” is a play on “fishing” and dates to the mid-1990s, when hackers used fake messages to steal AOL accounts.
- “Zero-day” describes a flaw that the software maker doesn't know about yet — defenders have had zero days to fix it.
- Year after year, lists of the most common passwords compiled from leaked data have been topped by entries like “123456” and “password”.
- Researchers estimate that roughly a million bitcoin mined in the first months of the network belong to Satoshi Nakamoto, and none of it has ever moved.
Frequently asked questions
Are these facts verified?
They come from public reporting and records. Contested points are marked as such.
How often are facts added?
The list grows over time.
Can I share a fact?
Yes. Use the share button on the homepage version to copy a link.