Hackers and Computer Crime: Understanding Threats and Defensive Measures

Every time a customer enters card details on an online store, clicks “pay now,” or logs into a seller dashboard, that transaction depends on trust. Hackers exploit exactly this trust. In e-commerce, a single security gap can expose thousands of customer records, drain a payment gateway, or replace a homepage with a defaced message overnight. Understanding how hackers operate and what “computer crime” actually covers is the first step toward building a business that customers can safely rely on.

Who is a hacker, really? 🔗

The word “hacker” gets used loosely, but there’s an important distinction. Ethical hackers (often called white hat hackers) test systems with permission to find weaknesses before criminals do. Black hat hackers break into systems without authorisation to steal data, cause damage, or make money illegally. Grey hat hackers sit in between, sometimes exposing flaws publicly without formal permission.

Under Indian law, the criminal side of this is spelled out clearly. Section 66 of the Information Technology Act, 2000 penalises anyone who dishonestly or fraudulently accesses a computer resource without the owner’s permission, and this is the section commonly used to prosecute hacking cases in India. So while “hacker” can describe a skilled technologist, “computer crime” is a specific legal category with real consequences.

How hackers actually get in 🔗

Hackers rarely break through a locked front door. They look for the window someone forgot to close. Common entry points include:

• Weak or reused passwords: Employees or customers using the same simple password across multiple sites.
• Unpatched software: Outdated plugins, content management systems, or server software with known vulnerabilities.
• Misconfigured servers: Open ports, exposed databases, or default admin credentials left unchanged.
• Human error: Clicking a malicious link or attachment, often through a convincing phishing email.

Once inside, the goal is usually one of three things: steal valuable data, damage or disrupt the system, or deface the website to make a public statement. To understand how this plays out, it helps to look at the three techniques most commonly taught in cybersecurity courses and most commonly seen in real breaches: spoofing, sniffing, and denial-of-service attacks.

Spoofing: pretending to be someone else 🔗

Spoofing means disguising communication so it appears to come from a trusted source. This could be a spoofed email that looks like it’s from your bank, a spoofed website that mimics your checkout page, or spoofed IP addresses that let an attacker slip past network filters undetected.

The real danger of spoofing is what it enables next. Once an attacker successfully impersonates a trusted entity, the door opens for further damage. According to cybersecurity firm Rapid7, spoofing is frequently used to launch denial-of-service attacks and man-in-the-middle attacks that intercept communication between two parties. A well-known variant relevant to e-commerce is business email compromise, where an attacker impersonates a manager or vendor to trick an employee into transferring money to a fraudulent account.

Common spoofing types 🔗

Sniffing: eavesdropping on data in transit 🔗

If spoofing is about pretending to be someone, sniffing is about listening in. Packet sniffing tools capture data as it travels across a network, letting an attacker read information that wasn’t encrypted properly. On an unsecured Wi-Fi network, this can expose login credentials, banking details, and other sensitive information passing between a customer’s device and a website.

A particularly relevant variant for network security is ARP spoofing, where forged messages trick a network into routing traffic through the attacker’s machine, which can be used both to hijack active sessions and to flood a network, effectively triggering a denial-of-service condition. Sniffing is also considered a “passive” attack in many cases, meaning the attacker stays silent and undetected while collecting data, which is exactly what makes it so hard to catch. Security researchers note that packet sniffing often serves as a launchpad for larger attacks, including distributed denial-of-service campaigns, once enough network intelligence has been gathered.

Denial-of-service attacks: shutting the doors on legitimate users 🔗

A denial-of-service (DoS) attack floods a server, application, or network with so much traffic that it can’t respond to genuine requests. When this flood comes from many compromised devices simultaneously, often without their owners’ knowledge, it’s called a distributed denial-of-service (DDoS) attack.

For an e-commerce business, a DoS attack during a major sale event can mean hours of lost revenue, frustrated customers, and long-term damage to brand trust. Attackers sometimes combine this with extortion, demanding payment to stop the flood of traffic. Because DoS attacks don’t necessarily involve stealing data, businesses sometimes underestimate them, but the operational and reputational cost can rival that of an actual data breach.

The real cost of these attacks 🔗

The scale of this threat in India has grown sharply. Government data shows cybersecurity incidents rose from 10.29 lakh in 2022 to 22.68 lakh in 2024, reflecting how quickly the attack surface is expanding as more businesses and consumers move online. For an individual e-commerce company, the consequences of a successful attack typically fall into three buckets:

• Data theft: Customer names, addresses, payment details, and order histories sold on dark web forums or used for identity fraud.
• System damage: Corrupted databases, disabled checkout systems, or ransomware locking critical business files.
• Website defacement: Homepage content replaced or altered, often visible to every visitor until it’s fixed, causing immediate reputational harm.

Building a defence that actually holds up 🔗

No single tool stops every attack. Effective cybersecurity for an e-commerce business layers several defensive measures together.

Monitoring network traffic continuously 🔗

Intrusion detection and prevention systems watch network traffic for unusual patterns, such as a sudden spike in requests from one region or repeated failed login attempts. At the national level, India’s designated response agency for cyber incidents monitors and coordinates responses to major threats. CERT-In functions as the national nodal agency for responding to computer security incidents as they occur, issuing alerts and forecasts that businesses can use to stay ahead of emerging threats. Individual businesses should mirror this approach internally with firewalls, traffic monitoring tools, and regular vulnerability scans.

Educating users and employees 🔗

Technology alone can’t fix human error. Regular training on recognising phishing emails, using strong and unique passwords, and reporting suspicious activity immediately closes one of the most exploited gaps in any security setup. Even a well-configured server can be compromised if one employee enters their credentials into a spoofed login page.

Applying core technical safeguards 🔗

Beyond monitoring and training, a few non-negotiables include encrypting data both in transit and at rest, enabling multi-factor authentication on admin accounts, applying software patches promptly, and segmenting networks so a breach in one area doesn’t automatically expose everything else.

Where the law fits in 🔗

Cybersecurity isn’t only a technical concern in India, it’s a legal one. Beyond Section 66, the IT Act includes provisions covering identity theft, cheating by impersonation, and tampering with computer source documents, with penalties ranging from fines to imprisonment. Organisations handling sensitive data are also expected to report significant incidents to CERT-In, reinforcing the idea that cybersecurity is a shared responsibility between businesses, users, and regulators rather than something that can be handled quietly and internally.

What do you think? If your own online accounts were sniffed or spoofed tomorrow, would you know the warning signs before real damage was done? And should e-commerce platforms be legally required to disclose security incidents to customers faster than they currently do?

References

1. https://www.pib.gov.in/PressReleasePage.aspx?PRID=1881404&reg=3&lang=2
2. https://www.rapid7.com/fundamentals/spoofing-attacks/
3. https://www.geeksforgeeks.org/ethical-hacking/what-is-sniffing-attack-in-system-hacking/
4. https://cisomag.com/what-are-sniffing-attacks-and-how-to-defend-against-them/
5. https://www.pib.gov.in/PressNoteDetails.aspx?NoteId=155384&ModuleId=3&reg=3&lang=2
6. https://www.digitalindia.gov.in/di_ecosystem/indian-computer-emergency-response-team-icert/