Why do hackers hack ordinary people like me?
Most hackers hack for money, and ordinary people are targets because most attacks are automated: bots try stolen passwords and send scams to millions of people at once. Your logins, card details and identity can be sold, and your email or work account opens doors to your contacts and employer. You don't need to be important, just reachable.
▶ Try it
Why it matters
Attackers rarely pick people. They pick what is easy and resellable. Logins, card numbers and full identity kits are traded in bulk, so an ordinary inbox is still worth money and opens a path to your contacts.
In 7 minutes you'll be able to
- Stolen data has a price, and criminals profit from volume.
- Your accounts are keys to your contacts, your workplace and your identity.
- Attacks are about money, access or disruption.
What you'll practise
Dark-market prices
Stolen data is bought and sold on criminal marketplaces. Guess roughly what each item sells for.
The "I'm nobody" myth
Ada hears this every week. Help her answer it.
"I'm not important. Nobody would bother hacking me." What's wrong with that?
- Most attacks are automated and hit millions of people at once (Answer)
- Nothing. Hackers only go after celebrities and big companies
- Nothing, as long as you don't have much money
Apart from money, what makes your accounts valuable to a criminal?
- Access: to your contacts, your employer's systems and your identity (Answer)
- Nothing, if there's no money in them
Your NovaCorp email account gets hacked. Who is at risk?
- Only you
- You, your colleagues, NovaCorp's customers and suppliers (Answer)
Motive match
Almost every attack is about one of three things. Sort these attacks by motive.
- Ransomware locks your laptop and demands payment → Money
- Your login is stolen to get into the company network → Access
- A website is flooded with traffic to protest a decision → Disruption
- Your card details are sold on a marketplace → Money
- Your email is used to send phishing to all your contacts → Access
- A homepage is defaced with political slogans → Disruption
Remember
You're not too small to be a target. Automation makes everyone worth a try.
No one is too small to be targeted. Automation makes every account worth trying.
Key facts
- Microsoft reports that its customers face more than 600 million cybercriminal and nation-state attacks every day. · Source: Microsoft Digital Defense Report 2024
- More than 99% of the identity attacks Microsoft sees are password attacks, such as guessing or replaying leaked passwords. · Source: Microsoft Digital Defense Report 2024
- The FBI's Internet Crime Complaint Center received 880,418 complaints in 2023, with reported losses of more than $12.5 billion. · Source: FBI IC3, Internet Crime Report 2023
- Stolen logins, card numbers and identity documents are sold in bulk on criminal marketplaces. Prices vary by country, quality and date.
- Free breach-notification services such as Have I Been Pwned track billions of accounts exposed in data breaches, and you can check your own email address there. · Source: Have I Been Pwned
Updated:
Questions people ask
Why would a hacker want my account if I don't have much money?
Your account can be sold, used to scam your friends, or used to reset your other passwords. A work account can also be a way into your employer's systems.
Are most cyber attacks automated?
Yes. Most attacks are mass campaigns run by bots that try leaked passwords or send scam messages to millions of people at once. They don't choose you; they try everyone.
What is my personal data worth on the dark web?
Single items are often cheap: a login can sell for a few dollars, a card number for tens of dollars. Criminals make their money on volume, which is why they target everyone.
How do I find out if my data has been leaked?
Free breach-notification services let you check whether your email address appeared in a known data breach. If it did, change that password and any place you reused it, and turn on MFA.
Related terms