In 2013, the American retailer Target announced that the credit-card details of around 40 million customers had been stolen during the busy shopping period before Christmas. The breach was traced to an unlikely source: not Target's own systems, but a small company that maintained the shop's air-conditioning units. Login details belonging to that company had been phished, and once the attackers were inside the supplier's network, they were able to move sideways into Target's payment systems. The full clean-up is estimated to have cost Target more than 200 million dollars, and the head of the company was replaced within months. It is now widely accepted that a company is only as secure as its weakest supplier.
Unit 8 · Workbook
8A. Hacked! — Workbook
Extra practice for home study · with answer keys
How to use this workbook
- Try each exercise on paper first — don't peek!
- Tap Show answer on a single item, or use the big button above to reveal everything.
- Re-do anything you got wrong the next day.
1. Vocabulary — internet & cybersecurity
Choose the word or phrase that fits best.
A second code required alongside your password is called ___.
Fake messages designed to steal your login details are called ___.
When a company's systems are broken into by attackers, this is called an ___.
Malicious software that spies on or damages your device is called ___.
Someone pretending to be you online is known as ___.
A fix released to close a security hole is called ___.
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
2. Vocabulary — gap-fill
Complete each sentence with ONE word or phrase from the box (correct form).
Word bank — drag or tap, then tap a gap
- I got a message from what looked like Instagram — I clicked the link and I was drop .
- My password had been changed and I was completely drop of my own account.
- The bank automatically drop my card as soon as it noticed the strange payment.
- About a million social-media accounts are drop every single day.
- You now have to upload a video selfie to drop your identity.
- The nine hundred pounds will be drop within five working days.
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
2b. Vocabulary — discursive writing
Write 120–180 words: 'As our lives become increasingly digital, is it still possible to maintain complete personal privacy? Discuss the threats posed by cybercrime.'
Check your writing
- Use target lexis from the cybersecurity and internet sections
- Use varied C1-level grammar (e.g. passive reporting structures)
- Ensure logical cohesion and smooth transitions
- Maintain a formal or semi-formal academic register
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
3. Grammar — active → passive
Rewrite each active sentence in the passive. Don't mention the doer unless it adds information.
Hackers stole two million passwords last month.
Somebody has changed the email on my account.
A technician is scanning my laptop at the moment.
The bank will refund the money within five days.
You should update the software immediately.
Somebody might have installed a virus on the machine.
By midnight, they had blocked all the cards.
The company is investigating the incident.
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
4. Grammar — HAVE / GET something DONE
Rewrite each situation using HAVE or GET + object + past participle.
A technician scanned my laptop yesterday.
A specialist recovered her Instagram account.
I need someone to reset my password.
The bank is sending me a new card at the moment.
An expert will check the security tomorrow.
Someone stole my identity — I didn't do anything wrong.
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
5. Grammar — IT IS SAID THAT… / …IS THOUGHT TO…
Choose the correct impersonal report structure.
___ that a million accounts are compromised every day.
The attackers ___ to be based in Eastern Europe.
He is believed ___ over ten million pounds last year.
Two-factor authentication ___ to block 99% of automated attacks.
It is reported ___ the breach affected 30,000 customers.
The group ___ to have hacked several government sites last year.
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
6. Grammar — spot & fix the mistake
Each sentence has ONE mistake. Rewrite it correctly.
My account was hack yesterday.
My email has stolen.
I did my laptop scan by a technician.
Is said that the attackers are Russian.
He is thought to be stolen the money.
The software should updated immediately.
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
7. Reading — true / false / not given
Read the short text and mark each statement T, F or NG.
- About 40 million card details were stolen from Target.T / F / NG
- The attackers broke into Target's own systems directly.T / F / NG
- The initial victim was an air-conditioning maintenance supplier.T / F / NG
- The clean-up cost Target more than a billion dollars.T / F / NG
- The head of Target was arrested.T / F / NG
- The article's main lesson is that supplier security matters.T / F / NG
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
8. Writing — a short incident report
Write 100–120 words as an internal incident report about a real or imagined hack. Use at least 3 passive tenses, 1 HAVE/GET SOMETHING DONE, and 1 IT IS SAID/THOUGHT THAT.
Check your writing
- 100–120 words
- 3+ passive tenses (present / past / perfect / modal)
- 1+ HAVE/GET something DONE
- 1+ IT IS SAID/THOUGHT THAT / …IS THOUGHT TO
- 3+ cybersecurity vocab words
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
9. Listening — call to the bank fraud line
Listen to the phone call (a worried customer + a bank fraud officer — clearly different voices). Answer the questions. Play twice if you need.
🎧 Bank fraud-line call · ≈ 1:30
📄 Show transcript
A: Hello, you've reached the fraud department. My name is Sarah. How can I help you today?
B: Hi, I've just had an alert about suspicious activity on my debit card. It says nine hundred pounds has been taken.
A: I see. So, how much money has been taken from David's card?
B: £900. It's for a merchant called 'Global Digital Store'. I've never used them before.
A: Alright. What is the merchant name on the alert?
B: 'Global Digital Store'. This all started yesterday. I clicked on a link that said a parcel couldn't be delivered and asked for £1.20 to reschedule.
A: I understand. So, what did David do the day before that caused the problem?
B: I paid £1.20 on a link that claimed a parcel couldn't be delivered. I wish I hadn't now.
A: Don't worry, we'll sort this out for you. Your card has been blocked automatically, so no further transactions can go through.
B: Oh, thank goodness. So, what has already happened to the card?
A: It's been blocked automatically. Now, the refund for the £900 will be processed for you.
B: How long will the refund take?
A: It will appear in your account within five working days. Also, I highly recommend having your phone checked for any apps that were installed after you clicked that link.
B: Okay, I'll do that. So what else does the agent recommend?
A: Having his phone checked for any apps that were installed after the link was clicked. And one more thing: it is thought that scam texts will continue in the coming weeks, so no link asking for a small payment should be clicked. Please be extra vigilant.
B: Right, I'll definitely keep an eye out for those. What does the agent warn about the coming weeks?
A: It is thought that scam texts will continue, so no link asking for a small payment should be clicked.
- How much money has been taken from David's card?
- What is the merchant name on the alert?
- What did David do the day before that caused the problem?
- What has already happened to the card?
- How long will the refund take?
- What else does the agent recommend?
- What does the agent warn about the coming weeks?
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
10. Dictation — key sentences
Listen again and complete each line with the missing words.
🎧 Bank fraud-line call — key sentences
📄 Show transcript
A: Hello, you've reached the fraud department. My name is Sarah. How can I help you today?
B: Hi, I've just had an alert about suspicious activity on my debit card. It says nine hundred pounds has been taken.
A: I see. So, how much money has been taken from David's card?
B: £900. It's for a merchant called 'Global Digital Store'. I've never used them before.
A: Alright. What is the merchant name on the alert?
B: 'Global Digital Store'. This all started yesterday. I clicked on a link that said a parcel couldn't be delivered and asked for £1.20 to reschedule.
A: I understand. So, what did David do the day before that caused the problem?
B: I paid £1.20 on a link that claimed a parcel couldn't be delivered. I wish I hadn't now.
A: Don't worry, we'll sort this out for you. Your card has been blocked automatically, so no further transactions can go through.
B: Oh, thank goodness. So, what has already happened to the card?
A: It's been blocked automatically. Now, the refund for the £900 will be processed for you.
B: How long will the refund take?
A: It will appear in your account within five working days. Also, I highly recommend having your phone checked for any apps that were installed after you clicked that link.
B: Okay, I'll do that. So what else does the agent recommend?
A: Having his phone checked for any apps that were installed after the link was clicked. And one more thing: it is thought that scam texts will continue in the coming weeks, so no link asking for a small payment should be clicked. Please be extra vigilant.
B: Right, I'll definitely keep an eye out for those. What does the agent warn about the coming weeks?
A: It is thought that scam texts will continue, so no link asking for a small payment should be clicked.
- A payment of nine hundred pounds from my card.
- The card automatically.
- That page was set up your card details.
- The payment within five working days.
- It that these scam texts will continue for weeks.
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
11. 🔥 Challenge — sentence transformation
Rewrite the second sentence using 2–5 words including the KEYWORD.
1. Hackers have stolen my email address. → My email address ___. (KEYWORD: BEEN)
2. A technician scanned my laptop. → I ___ scanned. (KEYWORD: HAD)
3. People say the group operates from Russia. → The group ___ from Russia. (KEYWORD: SAID)
4. Somebody might have installed a virus. → A virus ___ installed. (KEYWORD: BEEN)
5. Experts believe he stole millions last year. → He ___ millions last year. (KEYWORD: THOUGHT)
6. We need someone to reset the password. → We need to ___ reset. (KEYWORD: GET)
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
12. 🔥 Challenge — the letter U
Group the words by their U-sound. Choose the correct sound.
'user'
'rule'
'update'
'menu'
'truth'
'trust'
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving
13. Self-check
Tick what you can now do confidently.
- I form the passive across all main tenses (present, past, perfect, future, modal).
- I use HAVE / GET SOMETHING DONE for services performed by others.
- I use IT IS SAID THAT… and SUBJECT + IS THOUGHT TO… to report impersonally.
- I know the past reference: IS BELIEVED TO HAVE + past participle.
- I use B2 cybersecurity vocabulary: phished, compromised, breach, 2FA, malware.
- I distinguish the three main U-sounds: /ʌ/, /juː/, /uː/.
Important notes
Ask the teacher: Write down anything you want to remember from this section. Your notes are saved automatically.
Auto-saving