TL:DR Based on our investigation so far, Reddit user passwords and accounts are safe, but on Sunday night (pacific time), Reddit systems were hacked as a result of a sophisticated and highly-targeted phishing attack. They gained access to some internal documents, code, and some internal business systems.

What Happened?

On late (PST) February 5, 2023, we became aware of a sophisticated phishing campaign that targeted Reddit employees. As in most phishing campaigns, the attacker sent out plausible-sounding prompts pointing employees to a website that cloned the behavior of our intranet gateway, in an attempt to steal credentials and second-factor tokens.

After successfully obtaining a single employee’s credentials, the attacker gained access to some internal docs, code, as well as some internal dashboards and business systems. We show no indications of breach of our primary production systems (the parts of our stack that run Reddit and store the majority of our data).

Exposure included limited contact information for (currently hundreds of) company contacts and employees (current and former), as well as limited advertiser information. Based on several days of initial investigation by security, engineering, and data science (and friends!), we have no evidence to suggest that any of your non-public data has been accessed, or that Reddit’s information has been published or distributed online.

How Did We Respond?

Soon after being phished, the affected employee self-reported, and the Security team responded quickly, removing the infiltrator’s access and commencing an internal investigation. Similar phishing attacks have been recently reported. We’re continuing to investigate and monitor the situation closely and working with our employees to fortify our security skills. As we all know, the human is often the weakest part of the security chain.

Our goal is to fully understand and prevent future incidents of this nature, and we will use this post to provide any additional updates as we learn and can share more. So far, it also appears that many of the lessons we learned five years ago have continued to be useful.

User Account Protection

Since we’re talking about security and safety, this is a good time to remind you how to protect your Reddit account. The most important (and simple) measure you can take is to set up 2FA (two-factor authentication) which adds an extra layer of security when you access your Reddit account. Learn how to enable 2FA in Reddit Help. And if you want to take it a step further, it’s always a good idea to update your password every couple of months – just make sure it’s strong and unique for greater protection.

Also: use a password manager! Besides providing great complicated passwords, they provide an extra layer of security by warning you before you use your password on a phishing site… because the domains won’t match!

…AMA!

The team and I will stick around for the next few hours to try to answer questions. Since our investigation is still ongoing and this is about our security practices, we can’t necessarily answer everything in great detail, but we’ll do our best to live up to Default Open here.

Got an email from my taxation filing company that a data breach happened and my name, date of birth, drivers license, social security, almost everything that matters has been breached.

Then got an email from Hertz with the same crap. Everything that is considered SPI (Sensitive Personal Information) has beeb breached.

What kind of a shitshow are these companies up to putting customers' sensitive information on the internet? Why can't they limit all this info on intranet? Can I sue these companies for letting my information out?

In the past probably 4 months, I've received 3 letters in the mail and 2 emails from different companies claiming that they have had significant data breaches and my personal information had been compromised. These companies have ranged from small companies to large medical groups and even an ISP.

I am not yet a cyber security professional, but seeking to become one in the near future, so I don't have much insight, but from what I've been able to gather from this community, and others like it, is it seems that companies have just been flat out neglecting their customer's personal information for the sake of shaving a few dollars off of their bottom line. Is this actually true? And if so WTF man. That's just insane.

I've been deep in password breach databases for the past month (yes, the legally available ones for research), and I need to share something that's been bothering me.

We've all been taught to create passwords like "P@ssw0rd123!" - uppercase, lowercase, numbers, symbols. Checks all the boxes, right?

Here's the problem: hackers know this too.

I analyzed 50,000 real passwords from recent breaches and found:

THE "STRONG" PASSWORD MYTH

Everyone follows the same patterns:

- First letter capitalized: 68% of passwords

- Numbers at the end: 42%

- Year of birth or "123": 38%

- Exclamation point as the special character: 31%

When everyone follows the same "random" pattern, it's not random anymore.

THE PASSWORD THAT BROKE MY BRAIN

I found two passwords in the breach:

1. "Dragon!2023" - Marked as "very strong" by most checkers

2. "purplechairfridgecoffee" - Often marked as "weak"

Guess which one appeared 47 times in the database? And which one was unique?

The four random words would take centuries to crack. The "strong" password? 3 days with modern GPUs.

WHAT I LEARNED BUILDING MY OWN GENERATOR

Most password generators suck because they use Math.random() - that's not actually random, it's pseudorandom. If someone knows the seed, they can predict every password.

I built one using window.crypto.getRandomValues() - actual cryptographic randomness. But here's the thing: even with perfect randomness, if you're only generating 8-character passwords, you're still screwed.

THE UNCOMFORTABLE TRUTH

The best password is one that:

1. You'll never remember (so it's truly random)

2. Is at least 16 characters

3. Is unique for every site

4. Lives in a password manager

Yeah, I know. We built all these password rules to avoid using password managers, and now we need password managers because of all the rules.

MY QUESTIONS FOR YOU:

What's the dumbest password requirement you've encountered? I'll start: a bank that required EXACTLY 8 characters. Not "at least 8" - exactly 8.

And how do you explain password managers to someone who writes passwords on sticky notes? (asking for my mom)

Stumbled across this today - anyone heard of it ?! Looks moderately strange to me.

https://www.macworld.com/article/2820280/shocking-security-breach-of-16-billion-logins-includes-apple-ids.html

Found article on the same from the Daily Mail entitled "Huge Data Link dubbed 'Mother of All Breaches' sees 26 BILLION records leaked ....." :https://www.dailymail.co.uk/sciencetech/article-12992157/Huge-data-leak-dubbed-Mother-Breaches-sees-26-BILLION-records-leaked-sites-including-Twitter-Linkedin-Dropbox-heres-check-youve-affected.html

From the Article ( will embed quote)

Apparently, nobody knows who's responsible for this breach ( yet), but apparently some of the hackers targeting Microsoft got identified.

https://www.bleepingcomputer.com/news/security/national-public-data-confirms-breach-exposing-social-security-numbers/