Reddit has acknowledged a recent cyberattack that resulted in the theft of sensitive company information. The company referred to the breach in a security alert as a “sophisticated and highly-targeted phishing attack”.
The attackers targeted Reddit employees by creating a fake internal network site, a phishing page designed to steal their login information and multi-factor authentication tokens. One employee fell for the trick, granting the attackers access to Reddit’s internal systems to obtain sensitive data and source code without malware.
“After successfully obtaining a single employee’s credentials, the attacker gained access to some internal docs, code, as well as some internal dashboards and business systems,” said Reddit in the security announcement.
“We show no indications of breach of our primary production systems (the parts of our stack that run Reddit and store the majority of our data).”
Users remain safe but advised to turn on two-factor authentication
Reddit stated that it does not believe the breach impacted its users.
Per the initial investigation conducted by multiple teams over several days, there is no indication that any private user data has been accessed or that Reddit’s information has been made public or shared online.
Reddit took the chance to urge users to enhance the security of their accounts, advising them to turn on two-factor authentication (2FA).
A spokesperson from Reddit said that the company is “actively investigating and closely monitoring the situation.”
It is not the first time Reddit has been into a hack. About five years ago, the platform was hacked through a similar method.
The breach in 2018 was far more severe than the recent hack. On that occasion, the perpetrators were able to acquire the current email addresses of users and even a backup of the database from 2007, which included account passwords.
Reddit says that the insights gained from a security breach that occurred five years prior are still relevant today.
The attackers targeted Reddit employees by creating a fake internal network site, a phishing page designed to steal their login information and multi-factor authentication tokens. One employee fell for the trick, granting the attackers access to Reddit’s internal systems to obtain sensitive data and source code without malware.
“After successfully obtaining a single employee’s credentials, the attacker gained access to some internal docs, code, as well as some internal dashboards and business systems,” said Reddit in the security announcement.
“We show no indications of breach of our primary production systems (the parts of our stack that run Reddit and store the majority of our data).”
Users remain safe but advised to turn on two-factor authentication
Reddit stated that it does not believe the breach impacted its users.
Per the initial investigation conducted by multiple teams over several days, there is no indication that any private user data has been accessed or that Reddit’s information has been made public or shared online.
Reddit took the chance to urge users to enhance the security of their accounts, advising them to turn on two-factor authentication (2FA).
A spokesperson from Reddit said that the company is “actively investigating and closely monitoring the situation.”
It is not the first time Reddit has been into a hack. About five years ago, the platform was hacked through a similar method.
The breach in 2018 was far more severe than the recent hack. On that occasion, the perpetrators were able to acquire the current email addresses of users and even a backup of the database from 2007, which included account passwords.
Reddit says that the insights gained from a security breach that occurred five years prior are still relevant today.
For all the latest Technology News Click Here
For the latest news and updates, follow us on Google News.
Denial of responsibility! TechNewsBoy.com is an automatic aggregator around the global media. All the content are available free on Internet. We have just arranged it in one platform for educational purpose only. In each content, the hyperlink to the primary source is specified. All trademarks belong to their rightful owners, all materials to their authors. If you are the owner of the content and do not want us to publish your materials on our website, please contact us by email – [email protected]. The content will be deleted within 24 hours.
