A system, method, and computer program product are provided for detecting hacked modems in a cable network system. A cable Internet service provider can provide the disclosed heuristic to determine whether a particular cable modem has likely been hacked by obtaining a score corresponding to this likelihood. This score, as well as information regarding failure and success of various tests, can be used to generate a report identifying the likelihood that various modems have been hacked.