The Hex Files
History and stories
How we got here: the people, mistakes and lucky breaks behind modern security.
No articles match those words. Try one word, such as email or passwords.
History and stories
How we got here: the people, mistakes and lucky breaks behind modern security.
- Story
The beer barrel letters that cost a queen her head
Mary, Queen of Scots trusted a secret mail route and a cipher. Her enemies built the route and read every letter.
1 min readRead - Story
The “Nigerian prince” scam is older than email
Letters promising a fortune in return for a small payment were circulating more than a century before email.
1 min readRead - Story
The magician who hacked the wireless in 1903
During a public demonstration of “secure” wireless messages in London, a stage magician sent his own message into the room.
1 min readRead - Story
The intercepted telegram that helped pull America into World War I
Germany sent a secret offer to Mexico in code, over cables it believed were safe. British codebreakers read it within a day.
1 min readRead - Story
The con man who sold the Eiffel Tower
In 1925, a con artist with fake government letterhead convinced a scrap dealer that Paris was quietly selling the Eiffel Tower.
1 min readRead - Story
Enigma was broken by habits as much as by math
Germany's Enigma machine could have stayed unbroken. Predictable messages and shortcuts by its operators helped the codebreakers in.
1 min readRead - Story
The gift that listened for seven years
Soviet schoolchildren gave the US ambassador a carved wooden seal in 1945. A listening device inside went unnoticed for seven years.
1 min readRead - Story
The first computer bug was a real moth
In 1947, operators found a moth stuck in a relay of the Harvard Mark II and taped it into the logbook.
1 min readRead - Story
The first computer password, and the first password theft
Passwords arrived on a shared MIT computer in the early 1960s. Within about a year, someone printed the whole password file.
1 min readRead - Story
The encryption company secretly owned by spies
For decades, governments around the world bought encryption machines from a Swiss company that was secretly owned by intelligence agencies.
1 min readRead - Story
Creeper and Reaper: the first worm and the first antivirus
In 1971, an experimental program hopped between computers on the early internet. Another program was written to chase it down.
1 min readRead - Story
Phone phreaks and the toy whistle that controlled the phone network
A whistle from a cereal box could take control of long-distance phone lines. Two future Apple founders built devices that did the same.
1 min readRead - Story
The first spam email was a product announcement
In 1978, a marketer sent an invitation to a few hundred people on the early internet at once. The complaints started immediately.
1 min readRead - Story
Elk Cloner: the first virus spread on floppy disks
In 1982, a 15-year-old wrote a prank program that copied itself from one Apple II floppy disk to the next.
1 min readRead - Story
The 414s: teenagers who got in with default passwords
In 1982 and 1983, a group of Milwaukee teenagers broke into dozens of computer systems, mostly by trying the passwords printed in manuals.
1 min readRead - Story
The movie that led to a presidential order on computer security
After watching the film WarGames, President Reagan asked whether a teenager could really break into military computers. The answer started a policy.
1 min readRead - Story
A 75-cent accounting error that caught a spy
In 1986, an astronomer looking into a tiny billing mismatch uncovered a hacker selling information to the KGB.
1 min readRead - Story
Captain Midnight took over HBO for four and a half minutes
In 1986, an engineer angry about satellite TV fees overpowered HBO's signal and put his own message on screens across the eastern United States.
1 min readRead - Story
The first PC virus came with its authors' phone number
In 1986, two brothers in Lahore wrote a virus that spread on floppy disks, and put their names, address and phone number inside it.
1 min readRead - Story
The Christmas card that jammed the world's networks
In December 1987, a holiday greeting drew a tree on screen and quietly sent itself to everyone in the reader's address book.
1 min readRead - Story
The Jerusalem virus waited for Friday the 13th
Found at Hebrew University in 1987, this early virus spread quietly and was set to delete programs on every Friday the 13th.
1 min readRead - Story
The Max Headroom TV hijacking was never solved
On one night in 1987, someone in a Max Headroom mask took over two Chicago TV stations. Nobody has ever been identified.
1 min readRead - Story
The Morris worm: the night the early internet slowed down
In 1988, a graduate student's experiment spread out of control and slowed thousands of computers. It changed how the internet handles security.
1 min readRead - Story
The first ransomware arrived in the mail
In 1989, thousands of floppy disks were mailed to researchers. After enough restarts, they locked the computer and demanded payment.
1 min readRead - Story
The hacker who rigged radio contests to win a Porsche
In 1990, Kevin Poulsen took control of the phone lines into a Los Angeles radio station so that he would be the winning caller.
1 min readRead - Story
The Michelangelo virus panic of 1992
News reports warned that millions of computers would be wiped on March 6, 1992. The real damage was much smaller, but the scare changed habits.
1 min readRead - Story
The 1994 bank heist done from a computer in St. Petersburg
In 1994, someone used stolen access details to move millions out of corporate accounts through Citibank's wire transfer service.
1 min readRead - Story
The famous hacker who mostly just asked
Kevin Mitnick was once the most wanted hacker in America. His most effective tool was the telephone.
1 min readRead - Story
Ariane 5: the rocket brought down by old code
Europe's new rocket broke apart 37 seconds after its first launch because of software copied from the older rocket it replaced.
1 min readRead - Story
Where “phishing” got its name
The word comes from 1990s scammers who posed as online service staff to steal passwords, borrowing the spelling from phone phreaks.
1 min readRead - Story
Back Orifice: a remote control tool released at a hacker conference
In 1998, a hacker group released free software that let someone control a Windows computer from anywhere, often without the owner knowing.
1 min readRead - Story
CIH: the virus that could stop a computer from starting
In April 1999, a virus erased hard drives across the world and, on some computers, damaged the chip needed to start them.
1 min readRead - Story
How Toy Story 2 was almost deleted
In 1998, a mistyped command started erasing the files for Toy Story 2, and the backups had not been working for a month.
1 min readRead - Story
Melissa: the virus that shut down company email
In 1999, a Word document mailed itself to the first 50 people in each victim's address book, and companies had to switch email off.
1 min readRead - Story
Y2K: the disaster that didn't happen
Y2K is remembered as a false alarm. It went quietly because of years of work, which is how good IT usually looks.
1 min readRead - Story
ILOVEYOU: the email everyone wanted to open
In 2000, a love letter attachment spread around the world in a day, because it came from people the recipients knew.
1 min readRead - Story
Mafiaboy: the teenager who knocked big websites offline
In February 2000, a 15-year-old in Quebec flooded Yahoo, eBay, Amazon and CNN with traffic until they stopped responding.
1 min readRead - Story
Klez: the worm that faked who sent it
Klez spread by email in 2001 and 2002, often claiming to be a security fix and forging the sender so the real source was hidden.
1 min readRead - Story
The worm named after a soft drink
In 2001, researchers named a fast-spreading worm after the soda they were drinking. The fix for the flaw it used was already a month old.
1 min readRead - Story
The Anna Kournikova virus: a picture that was not a picture
In 2001, millions of people received an email promising a photo of a tennis star. The attachment was a program that emailed itself onward.
1 min readRead - Story
Nimda: the worm that came in through every door
In September 2001, a worm spread through email, shared folders, websites and old server flaws all at once, and became the most widespread on the internet within hours.
1 min readRead - Story
The 2003 blackout started with a silent alarm
A software bug stopped the alarms in a power company control room. Operators did not know, and a local problem became a blackout for 55 million people.
1 min readRead - Story
The worm that spread around the world in ten minutes
In 2003, a tiny worm infected most of its possible targets within about ten minutes, taking down ATMs along the way.
1 min readRead - Story
Blaster: the worm that kept restarting computers
In August 2003, a worm spread to computers that had not installed a month-old Windows update, making them shut down over and over.
1 min readRead - Story
Mydoom: still the fastest-spreading email worm
In January 2004, an email that looked like a delivery error spread faster than any email worm before or since.
1 min readRead - Story
Sasser: the worm that grounded flights
In May 2004, a worm spread on its own between Windows computers that had not installed an update, disrupting airlines, newsrooms and hospitals.
1 min readRead - Story
“Samy is my hero”: the worm that spread through friend requests
In 2005, one MySpace user's profile code added him as a friend to anyone who viewed it. More than a million people ran it within a day.
1 min readRead - Story
The music CDs that secretly installed hidden software
In 2005, millions of music CDs installed hidden copy protection software on the computers that played them, and attackers used it to hide their own programs.
1 min readRead - Story
Albert Gonzalez and the store Wi-Fi that leaked millions of cards
Between 2005 and 2007, one hacker and his crew stole more than 170 million card numbers from retailers and payment companies.
1 min readRead - Story
The Storm Worm rode the headlines
In January 2007, a deadly European storm became the subject line for one of the largest malware outbreaks of its time.
1 min readRead - Story
The weeks a whole country was knocked offline
In 2007, waves of traffic flooded Estonia's government, banks and news sites for weeks, in one of the first attacks aimed at an entire country.
1 min readRead - Story
Zeus: the banking trojan that watched people sign in
From 2007, a piece of malware sat inside web browsers, recording bank sign-ins and changing what people saw on screen.
1 min readRead - Story
Conficker: the worm that infected millions and then waited
In late 2008, a worm spread to millions of Windows computers through a known flaw and weak administrator passwords. Then it mostly did nothing.
1 min readRead - Story
Koobface: the fake video update that spread through friends
Koobface sent messages from infected social media accounts to their friends, with a link to a video that needed a “player update.”
1 min readRead - Story
RockYou leaked 32 million passwords in plain text
A 2009 breach at a social app maker exposed 32 million passwords stored exactly as users typed them. The list is still used to guess passwords today.
1 min readRead - Story
Operation Aurora: when Google said it had been hacked
In January 2010, Google announced it had been targeted by attackers who also went after dozens of other companies, starting with a single link sent to employees.
1 min readRead - Story
Stuxnet: the code that broke machines
Discovered in 2010, Stuxnet quietly damaged industrial equipment while showing operators that everything was normal.
1 min readRead - Story
DNSChanger: when the internet's address book was swapped
Millions of computers were quietly changed to look up websites through criminal servers. The FBI had to keep those servers running for months after the arrests.
1 min readRead - Story
The PlayStation Network was dark for 24 days
In April 2011, an intrusion forced Sony to shut down its gaming network for more than three weeks, and details of 77 million accounts were exposed.
1 min readRead - Story
The security company hacked through a spreadsheet
In 2011, attackers got into RSA, maker of sign-in security tokens, through an email with a spreadsheet titled as a recruitment plan.
1 min readRead - Story
The security firm undone by one reused password
In 2011, a security company's CEO picked a fight with a hacking group. They got in through a simple website flaw and one password used everywhere.
1 min readRead - Story
DigiNotar: the company that vouched for fake websites
In 2011, a Dutch company that issued the certificates behind the browser padlock was hacked and issued fake ones, and it went bankrupt within weeks.
1 min readRead - Story
Knight Capital lost control of its trading in 45 minutes
A software update was copied to seven of eight servers. The eighth woke up old code that flooded the stock market with orders.
1 min readRead - Story
One hour, one journalist, his whole digital life erased
In 2012, attackers used customer service calls and linked accounts to take over a Wired writer's email, phone and laptop, and erase them.
1 min readRead - Story
The LinkedIn leak that came back four years later
In 2012, LinkedIn said about 6.5 million passwords were stolen. In 2016, it turned out the same breach had taken far more.
1 min readRead - Story
How a heating contractor's login led to a retail breach
In 2013, attackers got into a major retailer's network using a login stolen from its heating and air conditioning contractor.
1 min readRead - Story
The fake tweet that briefly crashed the stock market
In April 2013, a false post from the Associated Press account claimed explosions at the White House. Markets dropped within minutes.
1 min readRead - Story
Yahoo's breaches stayed hidden for three years
Every Yahoo account was affected by a 2013 breach. The public did not find out until 2016.
1 min readRead - Story
CryptoLocker: the ransomware that set the template
In 2013, ransomware with unbreakable encryption, a countdown clock and payment in Bitcoin turned file encryption into a business.
1 min readRead - Story
Heartbleed: the flaw in the padlock itself
In 2014, a mistake in widely used encryption software let anyone read pieces of a server's memory, including passwords and private keys.
1 min readRead - Story
Mt. Gox lost hundreds of thousands of bitcoins without noticing
The largest bitcoin exchange in the world shut down in 2014. Most of the missing coins had been taken out quietly over years.
1 min readRead - Story
Shellshock: an old bug in the internet's plumbing
In 2014, researchers found a flaw in a basic tool used by countless servers and devices. Attacks started within hours of the announcement.
1 min readRead - Story
The Sony Pictures hack: when attackers set out to destroy
In November 2014, attackers leaked a film studio's emails and unreleased movies, then erased its computers.
1 min readRead - Story
Carbanak: the bank robbers who came in by email
A criminal group got into banks with phishing emails, learned how staff worked, then had cash machines pay out on command.
1 min readRead - Story
The breach that took 22 million background checks
Attackers spent months inside the US government's personnel agency and took detailed background check records on millions of people.
1 min readRead - Story
The first attack to turn off a power grid
Two days before Christmas 2015, attackers switched off power to about 230,000 people in Ukraine. It started months earlier with an email.
1 min readRead - Story
The bank heist stopped by a spelling mistake
In February 2016, hackers sent payment orders worth close to a billion dollars from Bangladesh's central bank. A typo helped stop most of them.
1 min readRead - Story
Mirai: when cameras and routers took down the internet
In 2016, malware took over hundreds of thousands of cameras and home routers using their default passwords, then used them to knock major websites offline.
1 min readRead - Story
GitLab deleted its database and found its backups did not work
A tired engineer ran a delete command on the wrong server. Then the team discovered how many of its backup methods had been failing.
1 min readRead - Story
The typo that took down part of the internet
An engineer removing a few servers entered one value wrong. Thousands of websites and apps that relied on one storage service went down for hours.
1 min readRead - Story
WannaCry and the accidental kill switch
In 2017, WannaCry ransomware spread worldwide. A security researcher discovered an unexpected kill switch that helped slow the outbreak.
1 min readRead - Story
NotPetya and the server saved by a power cut
In 2017, an attack spread through a software update and wiped out a global shipping company's systems. One offline copy saved it.
1 min readRead - Story
Equifax: the update that was not installed
In 2017, attackers took personal records of about 147 million Americans from Equifax through a website flaw that had a fix two months earlier.
1 min readRead - Story
Atlanta's city government went back to paper
In 2018, ransomware shut down many of Atlanta's city services. Staff filled in forms by hand while systems were rebuilt.
1 min readRead - Story
Meltdown and Spectre: the flaws inside the processor
In January 2018, researchers revealed that the way modern processors speed themselves up could let programs read memory they should not see.
1 min readRead - Story
Baltimore had no written recovery plan when ransomware hit
In May 2019, ransomware took down most of Baltimore's city systems. Recovery took until September.
1 min readRead - Explainer
How ransomware evolved from floppy disks to extortion
From a posted floppy disk in 1989 to criminal groups that rent out their tools, ransomware has changed in ways that matter for how you protect a business.
1 min readRead - Story
Zoombombing: when strangers crashed the video calls
When everyone moved online in 2020, uninvited guests started joining video meetings and disrupting them.
1 min readRead - Story
The Twitter hack started with a phone call
In July 2020, the accounts of Barack Obama, Elon Musk, Apple and others posted a Bitcoin scam. Attackers got in by phoning Twitter staff.
1 min readRead - Story
SolarWinds: the attack that came through a trusted update
In 2020, attackers hid a back door inside an update for network monitoring software, and thousands of organizations installed it themselves.
1 min readRead - Story
The data center fire that destroyed backups too
In March 2021, a fire destroyed a data center in Strasbourg. Customers who kept their backups in the same building lost both.
1 min readRead - Story
The day Facebook disappeared from the internet
In October 2021, a configuration change cut Facebook, Instagram and WhatsApp off for about six hours. Even staff badges stopped working.
1 min readRead - Story
The warnings before Ireland's health service shut down
In May 2021, ransomware forced Ireland's national health service to shut down its IT systems. The attackers had been inside for two months.
1 min readRead - Story
When thousands of office email servers were broken into at once
In early 2021, attackers used four unknown flaws in on-premises Exchange email servers to break into tens of thousands of organizations.
1 min readRead - Story
Colonial Pipeline: one old password, one week without fuel
In May 2021, ransomware shut the largest fuel pipeline on the US East Coast. The attackers got in with a single password on an unused remote access account.
1 min readRead - Story
Log4Shell: the flaw hiding in a line of text
In December 2021, a flaw in a common piece of free software let attackers take over systems by getting them to record one line of text.
1 min readRead - Explainer
From passwords to passkeys: sixty years of signing in
How signing in went from a shared password file in 1961 to passkeys that cannot be phished.
1 min readRead - Story
Lapsus$: teenagers who talked their way into big companies
In 2022, a loosely organized group, some of them teenagers, broke into major tech companies mostly by tricking or paying people.
1 min readRead - Story
The day Canada's debit cards stopped working
In July 2022, a Rogers network failure cut internet and mobile service for millions and took down the national debit payment network.
1 min readRead - Story
23andMe: reused passwords exposed millions
Attackers logged in to 23andMe accounts with passwords leaked from other sites, then used a sharing feature to reach millions more profiles.
1 min readRead - Story
MGM Resorts: one phone call to the help desk
In September 2023, attackers called MGM's IT help desk pretending to be an employee. Within days, slot machines, room keys and hotel check-in were down.
1 min readRead - Story
MOVEit: one flaw, thousands of organizations
In 2023, a flaw in a widely used file transfer tool let a ransomware group steal data from more than 2,700 organizations.
1 min readRead - Story
The 2024 outage that had to be fixed one computer at a time
A faulty security software update crashed about 8.5 million Windows computers. Many had to be fixed by hand, and some needed recovery keys that were hard to find.
1 min readRead - Story
The missing sign-in step that stalled US health care payments
In 2024, attackers got into a company that processes a huge share of US medical claims through a remote access login without multi-factor authentication.
1 min readRead - Story
The XZ back door: a two-year con caught by accident
In 2024, an engineer noticed a half-second delay and uncovered a back door that someone had spent two years building into widely used free software.
1 min readRead
Have a question we haven't covered?
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.