Reddit’s going through a little turbulence right now, with side-wide protests against controversial changes to the company’s API policies. And now Reddit has to contend with hackers allegedly holding 80GB of confidential data to ransom. Though the two events are tangibly related.
The threat has come from the ransomware hackers BlackCat, sometimes known as ALPHV, which claims to have stolen 80GB of confidential data from Reddit during a breach back in February. The group is demanding Reddit hand over $4.5 million and reverse the controversial API changes that are effectively forcing third-party Reddit clients to shut down.
Reddit confirmed to TechCrunch that this threat was related to a February 9 cyber attack, but the spokesperson apparently declined to comment further. Reddit CTO Christopher Slowe previously confirmed that a “highly-targeted phishing attack” happened back in February, which involved hackers gaining access to employee information and confidential documents. Apparently no personal user data was accessed, including passwords and account information.
BlackCat posted demands on its dark website this past Saturday, in a post called “The Reddit Files." The group claims to have contacted Reddit twice, on April 13 and June 16, but received no response. The post also claims that it informed Reddit it would be waiting for the upcoming IPO, but decided to accelerate the timeline claiming the recent API controversy means it now “seems like the perfect opportunity”.
The group has said it’s confident Reddit won’t pay up, and expects to release the stolen data. However, BlackCat has not provided any evidence that it has the data, or that it was responsible for the February breach.
What’s going on at Reddit?
For those not in the know, Reddit recently changed the terms of its API pricing recently, raising costs for third-party developers. This massive rise in prices is essentially pricing out third parties, forcing them to shut down and has caused outrage across Reddit’s user base.
Many users dislike the first-party Reddit app, and relied on third-party services like Apollo to make their experience more tolerable. Subreddit moderators, who are unpaid volunteers, have also been vocal about how third-party tools help them moderate content more easily — and a large number of subreddits went dark last week in protest — with some promising to remain shut indefinitely.
Reddit CEO Steve Huffman has downplayed the impact these protests are having, adamant that the API pricing changes will still be going ahead. Apparently the move was inspired by changes Elon Musk made to Twitter, which involved the billionaire firing the vast majority of Twitter’s workforce and making a number of increasingly bizarre and controversial changes to the social network.
Reddit has been clamping down on protesting subreddits, threatening to replace moderators who continue to keep their respective subs locked down. This has led to some subreddits opening back up, though a number of them have found new ways to continue their protests.
r/pics is now a subreddit devoted to pictures of comedian and Last Week Tonight host John Oliver, while r/interestingasf**k (censorship ours) has shifted towards posting amateur porn. While there’s plenty of that on Reddit already, this is now happening due to the fact Reddit can’t host ads in NSFW communities — and users appear to be going all in.
Should you be worried about the Reddit hack?
This isn’t the first time Reddit has been hacked, and the site has definitely suffered far worse breaches than this. A 2018 breach saw hackers leave with a complete copy of Reddit’s data from 2007, including usernames, emails, private messages and hashed passwords.
Back in February Reddit claims that this hack only saw hackers acquire internal company data — like employee information and messages. That should mean your data, as a Reddit user, is fine. But we won’t really know the full extent until hackers release some data, assuming they make good on their threats.
But despite this, it’s never a bad time to do a privacy cleanup. So there’s no harm in changing the password on your Reddit account (and services that share the same login information) and setting up two-factor authentication. Or you can always go ahead and delete your Reddit account and start afresh. It takes about five seconds to accomplish.
