Hack-back is offensive cyber action directed at a suspected attacker or at infrastructure believed to support that attacker. It can include disrupting servers, disabling accounts, or attempting to recover stolen data. The idea sits between defense and retaliation: it may seem useful for stopping an intrusion, but it can also cross legal and operational boundaries very quickly.
In practice, hack-back is risky because attribution is rarely perfect. Attackers often use rented cloud systems, compromised machines, or shared services, so a counterstrike can hit the wrong party or create collateral damage. For defenders, that means any authorized response needs strict scope, logging, and approval controls. In cyber security, the term matters because it highlights the difference between protecting a network and taking action against a suspected source of harm.