Usually, Scoleri said, a hacker will send a company employee an innocuous e-mail with an attachment. If the hacker is smart, he will be able to fool the employee into opening the attachment by, for example, making the subject of the e-mail about the presidential election or something else timely or humorous. The attachment is a actually program that plugs into the company's server. Once it is opened, the hacker can snoop around the server and copy anything he wants, if it's not encrypted. And even if there is encrypted information, the hacker is already inside the server and can exploit weaknesses in the company's technology.
Hackers can also exploit bugs to impersonate the main system administrator, or super user.
From there you can get the credit card information. Almost every Web site is vulnerable in some way because as new technology is developed, the weaknesses of old technology are realized, said Jon Spreha, a Web administrator for the State of Pennsylania's Web site. A piece of software that is six months old can have over a dozen holes in it. And with the Internet, weaknesses are hard to keep secret. Sometimes dozens of sites are listed in just one day.