A hacker group has accepted the responsibility of the phishing attack on the Reddit website and stole 80 gigabytes of information of the company’s employees and advertisers, and has demanded $4.5 million in ransom in exchange for not publishing it.
According to Engjet, in February 2023, the Reddit website announced that it was the victim of a phishing attack that exposed internal documents, information dashboards, codes and contracts, along with information about advertisers and former and current employees.
None of this data was seen in the public domain, but that may change as the Black Cat ransomware group, also known as ALPHV, claimed responsibility for the hack and claimed to have 80GB of compressed data. The hacker group announced in a post titled “Reddit Files” that it would delete the data if the company paid $4.5 million and canceled the API price increase.
Blackcat obtained this information through a scheme that encouraged employees to visit a website designed to look like Reddit’s intranet gateway. One of the employees fell into this trap and the hackers were able to get the login information and secondary authentication tokens as well. This person later reported his mistake and experts believe that the said security leak did not expose the private information of the users.
Now, a few months after the incident, in the midst of rising API prices, the hackers have publicly revealed their identity. This cost increase forces third-party apps like Narwhal and Apollo to shut down. On the other hand, Christian Selig, the creator of Apollo, claims that he needs 20 million dollars a year to keep his business afloat. Developers fear that the loss of third-party apps will lead to more censorship and reduced monetization opportunities.
Leave a Reply