Today, Reddit reported to its users that a number of its systems had been breached by a hacker and that user data was accessed. The data that was compromised in the breach included current email addresses and an entire 2007 database housing passwords and usernames that had already been “hashed and salted”—meaning scrambled for protection.
The company is in the process of sending email messages out to all of the users who were affected by the incident. Most of these users include individuals who joined the Reddit community back in 2007 or before then.
The hacker responsible for the data breach also gained access to all of the email digests that were sent out by Reddit in June of this year, as well, meaning that the hacker could read email addresses of the users, as well as the relevant, safe-for-work subreddits followed by these users. The company recommends that any users still utilizing passwords that are same or similar to the passwords they were using back in 2007 should immediately change those passwords on Reddit and on other sites, as well.
Token-based two-step authentication via services like Google’s Authenticator or Authy is also being recommended by Reddit, due to the fact that the hacker used an SMS intercept attack in order to obtain access to Reddit’s systems.
In a post that the company addressed to its users, Reddit stated:
“We learned that SMS-based authentication is not nearly as secure as we would hope.”
Between the dates of June 14th and June 18th of this year, numerous employees of the company had their accounts compromised via Reddit’s source code hosts and cloud provider. Even though the company had indeed required two-step authentication, the hacker somehow was able to intercept the SMS verification and that was how they obtained access to the systems. This enabled the hacker to view source code and backup data, as well as other employee logs within the company’s systems. However, they did not have the ability to change any of that data.
Reddit ultimately uncovered the attack by June 19th and that was when it first started to investigate how extensive the damage was. At the same time, Reddit ramped up its security measures and the proper law enforcement entities were contacted. Reddit is currently cooperating with the investigation being carried out buy those law enforcement entities.
The Reddit hacker was able to view both public and private messages that were posted on the site from 2005 to 2007.
Please leave any comments about this article below:
