Hack back is retaliatory cyber action aimed at a suspected attacker or related infrastructure. It can include attempting to disrupt a server, recover stolen data, or delete malicious tools after a breach. The term is often used broadly, but in practice it refers to offensive activity, not ordinary incident response.
It matters because cyber defense is usually bounded by law, attribution limits, and collateral risk. An attacker may use shared hosting, stolen accounts, or proxy systems, so a counterstrike can hit innocent third parties or unrelated services. That is why defenders treat “hack back” as a high-risk option requiring strong evidence, clear authorization, and careful logging. In real operations, the safer alternative is to contain the intrusion, preserve evidence, and coordinate with law enforcement or the affected provider rather than retaliate directly.