Types of hackers explained: white hats, black hats, grey hats and everyone else

What a “hacker” really is

The word started as praise. A hacker was someone who was clever with computers and enjoyed working out how systems behave. In the news it now usually means a criminal, but in the security industry it is simply a description of skill. What matters is not whether someone can get into a system, but whether they have permission, and what they intend to do once they are in.

That is why security people talk about different kinds of hacker, often using the “hat” shorthand borrowed from old cowboy films, where the heroes wore white hats and the villains wore black. The labels are a simplification, and real people do not always fit neatly. They are still useful, because each group wants something different and works in a different way.

The three hats

White hat hackers

White hats, also called ethical hackers, use the same skills as attackers but with the owner’s permission. They are hired to test systems, find weaknesses and report them so they can be fixed. Typical work includes penetration testing, reviewing code, checking whether staff can be tricked by fake emails, and reporting a flaw to the maker through a proper channel (often called responsible disclosure). Our guide to ethical hacking explains how people get into this work.

Black hat hackers

Black hats break in without permission to benefit themselves or to cause harm. Most are motivated by money. They steal data, run ransomware, commit fraud or sell access to other criminals. Others want disruption or revenge. This is the group behind most of the scams and breaches we cover on this site, including the cases in our round-up of the biggest scams and hacks.

Grey hat hackers

Grey hats fall in between. They may probe a system without being asked, with no obvious intent to do harm, and then tell the owner or publish what they found, sometimes to pressure the owner into fixing it. Some see this as a public service. The law does not agree: in most countries, getting into a system without permission is an offence even when the motive is good. That risk is the main reason to prefer the white-hat route.

Other types you will hear about

• Script kiddies. Beginners who run tools and scripts written by others, without understanding how they work. They are usually less skilled, but they can still do real damage with a ready-made tool, and they often go after easy targets such as accounts with weak passwords.
• Hacktivists. People who use hacking to make a political or social point. Typical actions are defacing websites, leaking documents or overloading a site to knock it offline. Motivation is ideology, not money.
• State-sponsored hackers. Teams working for, or backed by, a government. They are well funded and patient, and they usually go after governments, defence, energy and other critical infrastructure, or steal secrets and money. Our article on Stuxnet covers a famous example, and the FBI attributed the 2025 Bybit crypto theft to North Korea (see Crypto Hacks Explained).
• Cyber terrorists. Groups that aim to cause fear or harm by attacking essential services. This is rarer than the headlines suggest, but it is the reason hospitals, utilities and transport systems are treated as high-risk.
• Criminal syndicates and organised groups. Professional gangs that run attacks like a business, sometimes with specialists for access, malware, negotiation and laundering money. Ransomware crews are the best-known example.
• Industrial spies. People or groups paid to steal a company’s designs, plans or customer lists, often for a competitor or a foreign state.
• Insiders. Current or former employees, contractors and partners who misuse the access they already have. The reasons include revenge, money, pressure from someone else, or a plan to take data to a new employer. Some insiders do harm by mistake, which is a separate problem we cover in where cyber threats come from.

What each type usually wants

Understanding motive explains a lot about how attacks look from the outside:

• Money: ransomware gangs, fraud rings, and most black hats. Targets are chosen because they are easy and likely to pay.
• Information: state-sponsored groups, industrial spies and some insiders. They want secrets, plans and personal data.
• A cause: hacktivists. They want attention and often choose targets because of what the organisation stands for.
• Disruption: some terrorist groups, some state actors and disgruntled insiders.
• Learning or reputation: script kiddies and some grey hats.

This matters because the lowest-effort targets are always chosen first. Most people are not being hunted by a government. They are being sorted by a criminal’s automatic tools into “easy” and “not worth it”. Your aim is to land in the second group.

How hackers reach their targets

Security teams talk about a “threat vector”, which just means the route an attacker uses to get in. Different types of hacker tend to use the same few routes:

• Phishing and fake messages that trick someone into handing over a password or opening something harmful. Try our phishing email checker.
• Stolen or weak passwords, often from earlier data breaches, reused on other accounts. See our breach checker.
• Unpatched software with known security holes.
• Unprotected networks, such as an open public Wi-Fi or a poorly set-up router.
• Trusted suppliers that get hacked first. Read about this in our guide to third-party breaches.
• People with access, either a mistake or a deliberate act.

Identifying the vector is how defenders decide what to fix first. If most attacks arrive by phishing, the best investment is training, email filtering and two-factor sign-in, not a new firewall.

Real cases, by type

Seeing the labels attached to real events makes them easier to remember. These are covered in more detail elsewhere on this site:

• State-sponsored: Stuxnet, the malware aimed at Iran’s nuclear programme, which spread through USB drives. See our Stuxnet article. The FBI also named North Korea as responsible for the US$1.5 billion Bybit theft in 2025.
• Organised criminal group: the Cl0p gang’s mass exploitation of MOVEit file-transfer software in 2023, which hit thousands of organisations. It is one of the cases in our round-up.
• Criminals using social engineering: the 2024 hijacking of the US Securities and Exchange Commission’s X account, which began with a SIM swap at a phone shop. See SIM swap scams.
• Everyday criminals: fake shops, marketplace overpayments and fake invoices. These make up most of what ordinary people meet. See fake online stores and fake invoice scams.

Myths about hackers

• “They are all geniuses.” Some are. Many rely on ready-made tools, stolen passwords and tricking people. Skill is often less important than patience and persistence.
• “They are always strangers.” Sometimes the person is a former employee, a contractor or someone you know. Access you gave is a risk when it is not removed.
• “I am too small to matter.” Automated attacks do not choose targets by size. They look for easy ones.
• “It is all done in an instant.” Serious attacks often take weeks, with a long quiet period before anything visible happens.
• “Hackers always wear black hats.” The industry depends on white hats, who find problems for a living so they can be fixed.

What this means for ordinary people

You do not need to guess who might attack you. The same defences work against almost every type:

1. Keep your phone, computer and apps updated.
2. Use a different password for every account, stored in a password manager.
3. Turn on two-factor authentication, starting with email.
4. Keep backups, with one copy offline. See the 3-2-1 backup rule.
5. Treat unexpected messages with suspicion, especially anything urgent or about money.
6. Limit who has access to what, at home and at work.

Sources

• Mitnick Security: Types of hackersAccessed October 13, 2026
• Akamai: What is a white hat hacker?Accessed October 13, 2026
• FBI IC3: North Korea responsible for US$1.5 billion Bybit hackFebruary 26, 2025

Published October 13, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.