I consider "hacking" to be any instance of an entity deliberately undermining the confidentiality, integrity or availability assurances (the CIA triad) of a tec

I consider "hacking" to be any instance of an entity deliberately undermining the confidentiality, integrity or availability assurances (the CIA triad) of a technical security control; be it passively or actively, and regardless of the apparent weakness of the control. Information security begins with confidentiality, which brings us to the concept of authorization and and the use of encryption. When Bob and Alice want to communicate in secret, they want to assure confidentiality, and they use encrypted messages. Then we also have integrity: when Bob and Alice are enjoying a confidential communication, they want to make sure no one has altered the messages even if they can't read them, so we get hash functions and MACs. Maybe Bob wants authentication: he wants to make sure the person who sent him the message really is Alice, even if he's already sure it's confidential and unaltered, so now we've got digital signature schemes. Eventually Alice decides she wants non-repudiation, or peer entity auth, etc. Every technical security control can be modeled as the practical implementation of one of these desires for a particular type of assurance. This is neat, because it precludes pernicious questions like, "Well what if it's weak and the 'hacker' just incremented a value in a URL" - we shift the slippery-slope problem of ascribing malicious intent to the legal sphere without sacrificing the cleanly drawn technical definition. Under this definition, I'd consider the individual in this story to have "hacked" their employer. A login interface is a technical security control designed to provide authorization/access control as a method of implementing confidentiality (among other things). The employee logged in as a user other than themselves, thereby undermining the control. Furthermore, he did it intentionally, which establishes the deliberation requirement. It was not a sophisticated hack, but then again real world hacking very rarely is technically sophisticated. Despite the composition of Blackhat/DEFCON proceedings every year, the median company is far more likely to be compromised through a social engineering or endpoint failure (e.g. executive is phished, employee pirates media and gets a virus, etc). EDIT: Apparently this is an unpopular answer, that's fine. But it's an answer that probably goes the farthest and with the fewest rabbit holes. Humans need to trust software in different ways, and if you deliberately break that trust by bypassing the implementation that assures it, you've hacked the software.