Reddit reveals details of security incident that gave hackers access to internal documents, code and internal business systems

Reddit has fallen victim to a security incident that has been described as a "sophisticated and highly-targeted phishing attack". Hackers targeted employees of the site a few days ago, and were able to gain access to "some internal documents, code, and some internal business systems".

The unknown attackers sent Reddit employees "plausible-sounding prompts" leading to a website that cloned the behavior of the company's intranet gateway. While able to use an employee's credentials to steal data and code, user accounts are not affected.

See also:

• Twitter reveals scant details of its controversial changes to API access, including 'a new form of free access'
• If you don't upgrade and pay for Microsoft Teams Premium you could lose your data
• tiny11 massively shrinks Windows 11, slashes system requirements and eliminates the need for TPM

Revealing details of the attack, which took place on Sunday, Reddit explains: "On late (PST) February 5, 2023, we became aware of a sophisticated phishing campaign that targeted Reddit employees. As in most phishing campaigns, the attacker sent out plausible-sounding prompts pointing employees to a website that cloned the behavior of our intranet gateway, in an attempt to steal credentials and second-factor tokens".

The company goes on to say:

After successfully obtaining a single employee's credentials, the attacker gained access to some internal docs, code, as well as some internal dashboards and business systems. We show no indications of breach of our primary production systems (the parts of our stack that run Reddit and store the majority of our data).

Exposure included limited contact information for (currently hundreds of) company contacts and employees (current and former), as well as limited advertiser information. Based on several days of initial investigation by security, engineering, and data science (and friends!), we have no evidence to suggest that any of your non-public data has been accessed, or that Reddit's information has been published or distributed online.

Reddit says that it was able to act rapidly to block the attack after the employee whose credentials were stolen reported the incident. An internal investigation is still on-going.

Reddit notes:

Similar phishing attacks have been recently reported. We’re continuing to investigate and monitor the situation closely and working with our employees to fortify our security skills. As we all know, the human is often the weakest part of the security chain.

Our goal is to fully understand and prevent future incidents of this nature, and we will use this post to provide any additional updates as we learn and can share more. So far, it also appears that many of the lessons we learned five years ago have continued to be useful.

You can monitor the latest updates as Reddit shares them here.

Image credit: vectoroksana / depositphotos