Reddit has confirmed it recently suffered what seems to have been a fairly significant cyberattack that saw attackers make off with sensitive company data.
In a security notice, Reddit described the incident as a “sophisticated and highly targeted phishing attack.”
The company noted that the attackers specifically targeted Reddit, constructing a fake intranet site that, in reality, was nothing more than a phishing landing page designed to steal Reddit employees’ login credentials and multi-factor authentication (MFA) tokens. It seems that no malware was used.
Internal documents accessed
After targeting an unknown number of employees, one fell for the trick, giving the attackers access to internal Reddit systems. There, they accessed sensitive data and Reddit source code.
“After successfully obtaining a single employee’s credentials, the attacker gained access to some internal documents and code, as well as some internal dashboards and business systems,” Reddit explained in the announcement.
“We show no indications of a breach of our primary production systems (the parts of our stack that run Reddit and store the majority of our data).”
The announcement also suggested that users shouldn’t be too worried about their accounts: “Based on our investigation so far, Reddit user passwords and accounts are safe,” it said.
Reddit said it was alerted to the cyberattack by the victim itself, who reported it to the company’s security team. According to BleepingComputer, further investigation has revealed that among the data stolen is the contact information for company contacts as well as contact information for current and former employees.
Furthermore, the crooks took data about company advertisers as well.
Reddit remains operational, and the cyberattack did not affect its performance in any way, the company concluded. It also said that it found no evidence that the attackers were able to breach the production systems used to run the website.
Via: BleepingComputer
