The BlackCat (ALPHV) ransomware gang is behind a February cyberattack on Reddit, the place the menace actors declare to have stolen 80GB of knowledge from the corporate.

On February ninth, Reddit disclosed that its techniques had been hacked on February fifth after an worker fell sufferer to a phishing assault.

This phishing assault allowed the menace actors to achieve entry to Reddit’s techniques and steal inner paperwork, supply code, worker information, and restricted information concerning the firm’s advertisers.

“After efficiently acquiring a single worker’s credentials, the attacker gained entry to some inner docs, code, in addition to some inner dashboards and enterprise techniques,” defined a publish by Reddit CTO Christopher Slowe, aka KeyserSosa.

“We present no indications of breach of our major manufacturing techniques (the components of our stack that run Reddit and retailer nearly all of our information).”

Nevertheless, Reddit stated that manufacturing techniques weren’t breached, and no consumer passwords, accounts, or bank card data had been impacted.

Whereas Reddit didn’t share many particulars on the phishing assault, they stated it was much like a phishing assault on Riot Video games that allowed hackers to achieve entry to techniques and steal supply code for League of Legends (LoL), Teamfight Techniques (TFT), and the corporate’s Packman legacy anti-cheat platform.

Throughout the assault on Riot, the menace actors demanded $10 million to not leak the stolen information. Nevertheless, when a ransom was not paid, the menace actors tried to promote the information for $1 million on a hacking discussion board.

BlackCat behind Reddit hack

As first noticed by Dominic Alvieri and shared with BleepingComputer, the ALPHV ransomware operation, extra generally referred to as BlackCat, now claims to be behind the February fifth cyberattack on Reddit.

In a “Reddit Information” publish on the gang’s information leak website, the menace actors declare to have stolen 80 GB of compressed information from the corporate throughout the assault and now plan on leaking the information.

The menace actors say they tried to contact Reddit twice, on April thirteenth and June sixteenth, demanding $4.5 million for the information to be deleted however didn’t obtain a response.

“I advised them in my first e-mail that I’d wait for his or her IPO to come back alongside. However this looks as if the proper alternative! We’re very assured that Reddit won’t pay any cash for his or her information,” threatened the ransomware operation.

“However I’m very pleased to know that the general public will be capable of examine all of the statistics they observe about their customers and all of the attention-grabbing confidential information we took. Do you know additionally they silently censor customers? Together with artifacts from their GitHub!”

Whereas Reddit declined to remark about BlackCat’s publish, BleepingComputer has been in a position to affirm that this is similar assault disclosed by Reddit in February.

It ought to be famous that whereas BlackCat is a ransomware gang, they didn’t encrypt gadgets on this assault.

The identical hacking group is believed to be linked to an identical assault on Western Digital in March 2023, inflicting a huge outage to the corporate’s My Cloud cloud service.

Whereas the menace actors behind the Western Digital assault initially claimed to not have a reputation, screenshots of the stolen information had been leaked on the ALPHV information leak website, with the menace actors taunting the corporate concerning the assault.

Western Digital despatched information breach notifications in Might, warning on-line retailer prospects that their information was stolen throughout the assault.