Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
Popular website Reddit suffered a cyberattack Sunday evening, which allowed hackers to access internal business systems and to steal internal documents and source code.
According to statements from the company, the threat actors used a phishing lure targeting Reddit employees with a landing page impersonating its internal site. The fake site attempted to steal the credentials and 2FA tokens of the employees.
Reddit Speaks on the Incident
Reddit posted a statement addressing the incident on the r/reddit subreddit. The threat actor was able to breach Reddit’s internal systems to steal data and source code, and it only needed the credentials of one employee.
After successfully obtaining a single employee’s credentials, the attacker gained access to some internal docs, code, as well as some internal dashboards and business systems. We show no indications of breach of our primary production systems (the parts of our stack that run Reddit and store the majority of our data).
Reddit Statement (Source: Reddit)
The data extracted contained contact information for hundreds of company contacts and employees (former and current), as well as limited advertiser information. After several days of investigation, Reddit has no evidence to suggest that any private information (such as credit card information, passwords etc.) of users has been published or distributed online.
Reddit also stated that there are no indicators showing that the threat actors were able to breach production systems used to run the website.
How Reddit Responded to the Incident?
The impacted employee immediately reported that they had been phished, and the security team rapidly took action by blocking the intruder’s access and starting an internal inquiry.
Reddit continues to monitor the situation closely and fortify their security. The company will provide updates as they uncover more details.
Reddit also reminded its users how to protect their accounts by setting up two-factor authentication, for an extra layer of security. It also encouraged the users who want to take their accounts’ security up a step to update their passwords every couple of months.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, Youtube, and Instagram for more cybersecurity news and topics.
Cristian is a Content Editor & Creator at Heimdal®, where he developed a deep understanding of the digital threat landscape. His style resonates with both technical and non-technical readers, proof being in his skill of communicating cybersecurity norms effectively, in an easy-to-understand manner.
