An unauthorized user who attempts to or gains access to an information system.