Reddit announces data breach that threatens anonymity of users

Many Reddit users choose to remain anonymous on the website in order to freely discuss controversial topics or post salacious pictures.</s>Security and data breaches have pretty much become the norm for tech companies as of late. There was the Equifax breach last year, the Timehop breach in July, and Facebook's Cambridge Analytica incident in March.

Now, Reddit has informed its user base that it has discovered a breach of its own: hackers recently accessed a site database containing login credentials for accounts created back in 2007.

To be clear, the breach didn't occur in 2007. Rather, it happened sometime between June 14 and June 18. However, users who created their account during 2007 may have had their information compromised. If you created your account any time after that, you're in the clear.

Due to Reddit's relatively anonymous nature, no personal information has been put at risk. Nobody's name, address, or banking information has been exposed.

With that said, the breach is still important: attackers were able to access login credentials. This data is less critical, but it could prove troublesome for users who haven't changed their password in a while.

Reddit says hackers were able to intercept the platform's SMS-based 2-factor authentication (2FA) system.

So, how did this breach occur? Reddit says hackers were able to intercept the platform's SMS-based 2-factor authentication (2FA) system.

"...we learned that SMS-based authentication is not nearly as secure as we would hope, and the main attack was via SMS intercept," Reddit CTO Christopher Slow said in a detailed statement. Slowe goes on to advise users to switch to a token-based 2FA system instead, such as Google Authenticator.

To prevent similar attacks from happening in the future, Slowe says Reddit has taken "measures to guarantee that additional points of privileged access to Reddit’s systems are more secure." These measures include the implementation of "enhanced logging" and additional layers of encryption.</s>A hacker broke into a few of Reddit's systems accessing some user data, including current email addresses and a 2007 database backup containing old encrypted passwords.

Reddit's founding engineer, Christopher Slowe, said in a post Wednesday on the social networking site that the hacker accessed data from the site's launch in 2005 through May 2007.

'Although this was a serious attack, the attacker did not gain write access to Reddit systems; they gained read-only access to some systems that contained backup data, source code and other logs,' Slowe wrote on Reddit.

According to Slowe, in addition to users email addresses and 'old salted and hashed passwords' being exposed all content, most of which is already public, was also leaked. He said some private messages 'from way back then' were also a part of the breach.

Slowe said Reddit learned on June 19 an attacker compromised a few of its employees' accounts between June 14 and June 18.

The breach was carried out by intercepting text messages that were meant to reach employees with one-time login codes, Reddit said, adding that it was notifying the affected users.

Slowe said the firm hired its first head of security nearly three months ago and 'so far he hasn't quit'.

Reddit said it was contacting affected users and would be resetting their passwords.

'If you signed up for Reddit after 2007, you're clear here,' he wrote.

Reddit co-founders Alexis Ohanian, who is married to tennis star Serena Williams, and Steve Huffman have not commented on the hack.</s>A copy of an old database backup containing very early Reddit user data from 2005 through May 2007 was accessed by the hacker.

Reddit learned on June 19 an attacker compromised a few of its employees’ accounts between June 14 and June 18.

Social media network Reddit said on Wednesday a hacker broke into a few of its systems and accessed some user data, including current email addresses and a 2007 database backup containing old encrypted passwords.

A copy of an old database backup containing very early Reddit user data from the site’s launch in 2005 through May 2007 was accessed by the hacker, the social media network said.

"Although this was a serious attack, the attacker did not gain write access to Reddit systems; they gained read-only access to some systems that contained backup data, source code and other logs," Reddit's founding engineer Christopher Slowe wrote here on Reddit.

Slowe said Reddit learned on June 19 an attacker compromised a few of its employees’ accounts between June 14 and June 18.

The breach was carried out by intercepting text messages that were meant to reach employees with one-time login codes, Reddit said, adding that it was notifying the affected users.

Slowe said the firm hired its first head of security nearly three months ago. “So far he hasn’t quit”.</s>Reddit says user data between 2005 and 2007 breached

NEW YORK: Social media network Reddit said on Wednesday a hacker broke into a few of its systems and accessed some user data, including current email addresses and a 2007 database backup containing old encrypted passwords.

A copy of an old database backup containing very early Reddit user data from the site´s launch in 2005 through May 2007 was accessed by the hacker, the social media network said.

"Although this was a serious attack, the attacker did not gain write access to Reddit systems; they gained read-only access to some systems that contained backup data, source code and other logs."

Slowe said Reddit learned on June 19 an attacker compromised a few of its employees´ accounts between June 14 and June 18.The breach was carried out by intercepting text messages that were meant to reach employees with one-time login codes, Reddit said, adding that it was notifying the affected users. Slowe said the firm hired its first head of security nearly three months ago.</s>Social news site Reddit revealed Wednesday that it has been a victim of hackers.

The company released a statement alerting users that a hacker broke into a few of its systems and managed to access some user data, including “some current email addresses and a 2007 database backup containing old salted and hashed passwords.”

Reddit said it learned of the incident on June 19 and the apparent breach happened between June 14 and 18. Additionally, the site said the alleged hacker also compromised a few of its employees’ accounts with its cloud and source code hosting providers.

“Although this was a serious attack, the attacker did not gain write access to Reddit systems; they gained read-only access to some systems that contained backup data, source code and other logs. They were not able to alter Reddit information, and we have taken steps since the event to further lock down and rotate all production secrets and API keys, and to enhance our logging and monitoring systems,” the company added.

Reddit also said it is messaging all affected users and advising them to reset their passwords on accounts where the credentials might still be valid.

“If you signed up for Reddit after 2007, you’re clear here. Check your PMs and/or email inbox: we will be notifying you soon if you’ve been affected.”

Reddit said it has also reported the issue to law enforcement and is taking measures to guarantee its systems are more secure in the future.</s>A copy of an old database backup containing very early Reddit user data from the site's launch in 2005 through May 2007 was accessed by the hacker, the social media network said.

"Although this was a serious attack, the attacker did not gain write access to Reddit systems; they gained read-only access to some systems that contained backup data, source code and other logs," Reddit's founding engineer Christopher Slowe wrote on Reddit.

Slowe said Reddit learned on June 19 an attacker compromised a few of its employees' accounts between June 14 and June 18.

The breach was carried out by intercepting text messages that were meant to reach employees with one-time login codes, Reddit said, adding that it was notifying the affected users.

Slowe said the firm hired its first head of security nearly three months ago. "So far he hasn't quit".</s>Reddit was victim of a serious hack that has compromised the security of some of its users’ data, the social network announced Wednesday.

In a statement published to the site, Reddit informed its users that it learned on June 19 that an attacker had gained access to the data through the company’s cloud after compromising some employee accounts sometime between June 14-18. Although the breach was described as being “serious,” it was mainly limited to data, including emails and scrambled passwords, prior to 2007. The hacker did not gain write access to its systems, meaning they were unable to alter Reddit information.

“Now that we’ve concluded our investigation sufficiently to understand the impact, we want to share what we know, how it may impact you, and what we’ve done to protect us and you from this kind of attack in the future,” the site said.

Reddit encourages users to change their passwords if they are similar to those they had in 2007 and to enable token-based two-factor authentication as the hackers reached its systems through SMS intercept.

“We learned that SMS-based authentication is not nearly as secure as we would hope,” said Reddit.

The hacker might have also obtained emails through digests it sent in early June, according to the statement. If so, Reddit users could be potentially robbed of their anonymity if usernames are connected to emails. A user pointed out in the comment section that if privacy is a concern, affected users should delete any “incriminating” posts they could otherwise be traced back to.</s>Popular content aggregation platform Reddit was the subject of a database breach back in June 2018.

According to an August 1st, 2018 announcement made by Reddit CTO and founding engineer Christopher Slowe, under his KesyerSosa username, a hacker managed to breach Reddit’s systems and access current email addresses as well as a 2007 database backup filled with old, encrypted passwords.

The backup reportedly contained early user data, including information from Reddit’s launch in 2005 until May 2007.

“In Reddit’s first years it had many fewer features, so the most significant data contained in this backup are account credentials (username + salted hashed passwords), email addresses, and all content (mostly public, but also private messages) from way back then,” wrote Slowe, in his August 1st post.

The hacker was able to access Reddit’s internal system between June 14th and June 18th, 2018, by accessing the accounts of some Reddit employees.

According to Slowe, the main attack was conducted by intercepting a two-factor authentication code sent through SMS.

Slowe added that Reddit was made aware of the breach on June 19th, 2018, and has since been working alongside cloud and source code hosting providers to learn more about the attack.

Reddit is also in contact with U.S. law enforcement entities and is cooperating with an investigation.

“Although this was a serious attack, the attacker did not gain write access to Reddit systems; they gained read-only access to some systems that contained backup data, source code and other logs,” said Slowe.

“They were not able to alter Reddit information, and we have taken steps since the event to further lock down and rotate all production secrets and API keys, and to enhance our logging and monitoring systems.

The website is currently in the process of informing affected users. Slowe recommended that users change their passwords and utilize a token-based two-factor authentication system.

“If you signed up for Reddit after 2007, you’re clear here,” said Slowe.

“Whether or not Reddit prompts you to change your password, think about whether you still use the password you used on Reddit 11 years ago on any other sites today.”</s>Forum website Reddit has confirmed it was the victim of a data breach which has compromised usernames, passwords and email addresses but has not confirmed the size of the breach.

The website confirmed two sets of data had been accessed by hackers who broke in using compromised employee accounts – one from 2007 which included account details and all public and private posts between 2005 and May 2007.

A second, likely larger set of data was also accessed between June 3 and 17 this year, which included logs and databases linked to the daily email digests Reddit sends out to users.

This data includes usernames and email addresses linked to those accounts.

The firm said it discovered the breach on June 19, with the attack having taken place during the four previous days.

Reddit said it was messaging user accounts “if there’s a chance the credentials taken reflect the account’s current password” and has urged users to check their Reddit inboxes as well as their emails to establish if they were affected by either breach.

“If your account credentials were affected and there’s a chance the credentials relate to the password you’re currently using on Reddit, we’ll make you reset your Reddit account password,” the firm’s chief technology officer Christopher Slowe said.

“Whether or not Reddit prompts you to change your password, think about whether you still use the password you used on Reddit 11 years ago on any other sites today.

“If your email address was affected, think about whether there’s anything on your Reddit account that you wouldn’t want associated back to that address.”

The forum said the employee accounts had been accessed when hackers were able to breach the two-factor authentication used to confirm log-in.

It used a text message system that required employees to enter a code sent to them via SMS as well as normal log-in details when trying to access the site.

However, Reddit said hackers had intercepted those text messages.

In response to the attack, cybersecurity experts have warned users to be vigilant of any phishing scams that could be attempted using the stolen data.

Robert Capps, vice president at NuData Security, said: “Fortunately, this Reddit breach doesn’t include credit card information.

“However, we all know bad actors are very talented at preparing fraud schemes with the kind of user information that was leaked.

“From phishing scams and dictionary attacks – where fraudsters try certain common passwords based on the user’s information – to synthetic identities, as little as an email address can go a long way in the hands of a bad actor.

“Reddit is doing the right thing by immediately informing its global community of the extent of the damage, advising of the steps Reddit is taking and letting its community know what they should watch for and do.”
Reddit reports a data breach consisting of emails and usernames. The site states that the perpetrators had access to information on accounts which were subscribed to their newsletter between the 3rd and 17th of June, as well as those created between 2005 and 2007.