Reddit was hacked via phishing campaign that provided employee login details

Reddit has suffered a hack of its systems. According to the company, a phishing campaign was carried out targeting Reddit employees. An employee’s login details were obtained, after which the attacker gained access to the systems.

Reddit writes that on February 5, it became aware that a “sophisticated phishing campaign” was underway, sending “credible prompts” to employees. They redirected to a website that ‘clone the behavior of our intranet gateway’.

Ultimately, the attacker was able to obtain an employee’s data, gaining access to “some internal documents, code and some internal dashboards and business systems.” The attacker also gained access to hundreds of company contacts and the data of former and current employees, in addition to “limited advertiser information,” Reddit reports.

Based on an investigation that took several days to complete, Reddit states that there is no evidence that non-public user data was accessed and no Reddit information was published or distributed.

Reddit writes that users’ passwords and accounts are secure. Furthermore, the discussion platform reports that there are no indications that access has been gained to primary systems. This concerns the systems on which Reddit partly runs and where the majority of the data is stored.