Reddit, the popular social media platform with over 50 million daily users, has confirmed a phishing attack that led to the unauthorized access of internal documents and source code.
An unknown attacker sent “plausible-sounding prompts” to Reddit employees on February 5th, redirecting them to a fake website resembling Reddit's intranet portal, in an attempt to steal login credentials and two-factor authentication tokens, according to Reddit CTO Christopher Slowe, also known as KeyserSosa. Slowe added that similar phishing attempts have been reported recently and compared the Reddit breach to the recent Riot Games hack.
Attackers Gain Access to Internal Documents
An employee's credentials were successfully obtained, granting the attackers access to internal documents, source code, business systems, and internal dashboards. The breach was discovered after the affected employee reported the incident to Reddit's security team, who promptly cut off the hackers' access and initiated an internal investigation.
Although the hackers accessed contact information for current and former employees and some advertiser information, Reddit has found no evidence of stolen, published, or distributed personal user data or other confidential information.
Reddit to users: Use two-factor authentication
In response to the breach, Reddit recommends that all users set up two-factor authentication on their accounts and use a password manager for added security.
“We are continuing to investigate and monitor the situation closely and working with our employees to fortify our security skills,” said Slowe. “As we all know, humans are often the weakest part of the security chain.”
This is not the first time Reddit has faced a data breach. In 2018, a complete copy of Reddit's data from 2007, including usernames, hashed passwords, emails, public posts, and private messages, was accessed without authorization.
Increased Number of Data Breaches
Data breaches have now become more rampant than they used to be. Therefore it's important to take the necessary steps to ensure your data is secure, whether for personal or business use.
In fact, the number of people affected by a data attacks increased by 42% to 422.1 million last year. A big chunk of this was because of a Twitter breach that happened in December, resulting in the information of 221 million users leaking online.
In August 2022, threat actors broke through the security measures of the popular password manager LastPass and were able to enter the development environment of the service. In December, another breach at Lastpass was even more dangerous as it affected the data of LastPass users.
Tip of the day: When using your Windows 10 laptop or convertible with a mobile hotspot you might want to limit the Internet bandwidth your PC uses. In our tutorial we are showing you how to set up a metered connection in Windows 11 or Windows 10 and how to turn it off again, if needed.
