Captain Zap and the AT&T Clock Hack: Lessons for Small Businesses

Hackers & Hooks | Season 1, Episode 4

In 1981, as the story is usually told, a young hacker who went by Captain Zap got into AT&T’s computers and changed what time the billing system thought it was. Afternoon callers suddenly got the late-night discount. People who waited until midnight to call long distance paid peak rates instead.

On this episode of Hackers & Hooks, Nick Gipson and Isaac Reed dig into Ian Murphy, the man behind the Captain Zap name, and why a prank from the early days of computing still matters to anyone who runs a business on phones, email, and cloud accounts today.

The Hacker Who Flipped the Clock

Ian Murphy is one of the harder figures in hacking history to pin down. As Nick points out in the episode, surprisingly little has been written about him, and some of what has been written is disputed. The core of the story, repeated in many accounts, is this: in 1981, Murphy and a few associates got into AT&T’s computer systems and changed the internal clocks that set billing rates. Daytime callers were charged the discounted off-peak rate, and night callers were charged the peak rate.

Isaac called him a 1980s Robin Hood, since plenty of ordinary callers came out ahead. The phone company did not see it that way. Murphy was arrested and, by most accounts, convicted in 1982. The sentence most often reported is 1,000 hours of community service and two and a half years of probation. He is often described as one of the first hackers convicted in the United States. There was no modern computer crime law to charge him under yet, so the case reportedly relied on older theft-related laws. The Computer Fraud and Abuse Act, the main U.S. anti-hacking law today, was not passed until 1986.

The episode’s fishing segment made a similar point the hard way. Isaac described a near head-on collision on a narrow bend of an Arkansas river, when another boat came through far too fast for the space available. Nobody was badly hurt, but the lesson stuck: ignoring limits, on the water or on a network, puts other people at risk. His sign-off is worth repeating.

“Until next time, wear a life jacket, check your logs, keep your passwords tight.”

Isaac Reed, Hackers & Hooks

Built for Convenience, Not Caution

Nick summed up the era in one line: minimum security with maximum usability. Phone and computer systems were designed to make life easy for customers and technicians. Few people imagined that anyone would want to tamper with them. In Nick’s view, the bigger failure was that nothing flagged the change: no log anyone was reviewing, no alert, and no one with any idea it was happening. A billing clock is a small setting with a large financial effect.

That pattern is not just history. Many small businesses run on systems that were set up for convenience: shared logins, default settings nobody revisited, and admin rights handed out so people can “just get their work done.” When something is changed quietly, such as a vendor’s bank details, an email rule that forwards messages to an outsider, or a security setting that gets switched off, the business impact shows up later as lost money, disrupted operations, or a hard conversation with customers and your insurer.

The hosts also used the episode to talk about a pattern they have seen in every story so far: attackers who succeed because a trusting person believes they are talking to a colleague. Skilled social engineers (people who manipulate staff rather than machines) learn company lingo and internal details so they sound like they belong. As Nick put it, it is often less about the attacker being brilliant and more about the person on the other end having no reason to doubt them.

“We need to stop immediately trusting whoever calls us on the phone just because they’re nice to us and they use the same lingo we use.”

Nick Gipson, Hackers & Hooks

Lessons for Small Businesses

• Log important changes, and have someone review them. Nick’s first takeaway is to always have a way to review past activity. Turn on audit logging for email, banking, payroll, and cloud accounts, and make sure someone actually looks at alerts about changes to settings, payment details, or user permissions.
• Give people only the access they need. The principle of least privilege means each person gets the access their role requires and nothing more. As Nick points out, that includes the owner. Fewer admin accounts means fewer keys for an attacker to steal.
• Verify callers before you act. If someone calls claiming to be from IT, your bank, or a vendor and asks for a password, a code, or a change, hang up and call back on a number you already have. Friendly and familiar is not the same as verified.
• Replace default and weak passwords. Change default passwords on every device and service, use a password manager, and turn on multi-factor authentication (a second check, such as a code on your phone) wherever it is offered.
• Put permission in writing. Nick is firm that anyone testing or working on systems they do not own needs signed, written authorization first. For a business, that means a clear written scope for every IT provider, consultant, or security tester you bring in.
• Train your people. Nick’s view is that user training is the best defense against social engineering. Short, regular sessions help staff recognize pressure tactics and know who to call when something feels off.

How Gipson Cyber Helps

The lesson from Captain Zap is that quiet changes cost money when nobody is watching. That is the idea behind 24/7 cybersecurity monitoring for small business: someone is paying attention to unusual activity, including overnight and on weekends. Gipson Cyber’s Business SOCaaS provides 24×7 monitoring with real human responders who review suspicious activity and help you decide what to do about it. It is technology-agnostic, so it works with the tools you already have, and it is designed to work alongside your existing IT team or MSP rather than replace them.

If something has already gone wrong, our Business DFIR team provides small business incident response, helping you understand what happened and respond, with clear reporting you can share with leadership, your insurer, or legal counsel. If you think you are being hacked right now, go to 800cyber.com.

No service can stop every attack. The goal is to shorten the time between a quiet change and someone noticing it, so a small problem has less chance to become an expensive one.