The Chaos Computer Club and the 1984 BTX Hack in Hamburg

In November 1984, a Hamburg bank found itself owing a large sum of money to a computer club. The club had not stolen anything. It had used a flaw in the German videotex system to make the bank pay for pages on the club's own service, and then it called a press conference to explain exactly how. The money was returned the next day. The Chaos Computer Club had made its point and, in the process, defined a style of ethical hacking that is still associated with Germany.

Who the Chaos Computer Club were

The Chaos Computer Club, or CCC, was founded in Berlin in 1981 around the Tageszeitung newspaper's offices. Wau Holland, whose real name was Herwart Holland-Moritz, was its best-known founder. The club brought together people who were curious about computers, telephone networks and what technology meant for privacy and society. It held its first annual congress in Hamburg in December 1984, a tradition that continues as the Chaos Communication Congress, now one of the largest hacker gatherings in Europe.

The CCC was never simply a group of intruders. From early on, it argued that people had a right to understand technology and that governments and companies should be accountable for the security of systems that held personal data.

What BTX was

Bildschirmtext, usually abbreviated BTX, was a videotex service run by the German postal and telecommunications authority, the Deutsche Bundespost. Users connected a terminal or a special adapter to their television and telephone line to read pages of information, order goods, and use online banking. It was an early, centralised ancestor of the web, and the Bundespost promoted it as safe and modern.

One feature mattered here. Information providers could publish pages and charge users a fee for each call. The provider received the fees through the Bundespost's billing.

The Hamburg stunt

According to accounts from the club members involved, including Steffen Wernéry and Wau Holland, the CCC found a weakness that gave them access to the credentials used by the Hamburger Sparkasse, a savings bank, to connect to BTX. With those details, they could make the bank's access call paid pages. The club set up a page of its own that cost a little under ten marks per call, and then had the bank's connection call it again and again overnight.

By the morning, the bill came to roughly 135,000 Deutschmarks. The club did not keep it. They informed the bank, held a press event, and arranged for the sum to be reversed. Their message was that a system holding financial data had a basic security failure that the Bundespost had been unwilling to acknowledge.

Why it caused such a stir

The incident was widely covered in the German media. It undermined the claim that BTX was secure, and it contributed to a broader public conversation about data protection, which was already sensitive in West Germany following the 1983 census controversy and the constitutional court's recognition of a right to informational self-determination. It also won the CCC a reputation as a group that exposed flaws in the open instead of exploiting them quietly.

The Bundespost fixed the specific problem. BTX continued for years but never reached the numbers its backers had hoped for, and the rise of the internet and the web in the 1990s eventually replaced it.

The stunt also worked because of timing. Germany in the mid-1980s was debating how much personal data the state and large institutions should be allowed to hold, and the public was ready to listen to a group that could show, with a concrete example, how fragile the systems holding that data could be. The club's willingness to explain every step to journalists made the demonstration persuasive. It was not an act of theft dressed up as a protest; the reversal of the payment was part of the plan from the start.

The hacker ethic, Hamburg style

Over the years, the club developed a written set of principles, usually called the CCC hacker ethic. Among them are the ideas that access to computers should be unlimited, that information should be free, that authority should be mistrusted, and, importantly, that you should not litter other people's data. A later addition says that public data should be used and private data should be protected. In practice, that means the club has often publicised weaknesses in systems that handle personal information, from biometrics to government software, while stressing disclosure over exploitation.

Why disclosure became a model

• It forces the owner of a system to take responsibility for fixing the problem.
• It warns users, who can then protect themselves.
• It reduces the chance that a flaw is exploited quietly by criminals first.

Modern coordinated disclosure and bug bounty programmes follow the same logic, though they usually add rules about timing and permission that the club's early stunts did not have.

The lesson for site owners today

The BTX case was an authentication failure: whoever held a set of credentials could act as the bank. Credential theft remains one of the most common causes of website compromise. A leaked password or API key from one service can be reused on another, and automated tools try stolen logins at enormous scale.

• Use a different password for every service.
• Turn on two-step verification for your hosting, email and domain accounts.
• Rotate keys and tokens when staff leave or a service is breached.
• Respond openly and quickly if someone reports a flaw on your site.

For a wider baseline of measures, see the security page.

Putting it into practice

Business email carries your password resets, so it deserves the same care as your website. Our business email hosting is managed in Plesk, and the security page explains how we think about account protection. Zebra Hosting is based in Europe, and support is offered in 17 languages if you want help in your own.