Reddit data breach 2018: what happened and what to do

What happened

On June 19, 2018, Reddit found that an attacker had broken into accounts belonging to a few of its employees at its cloud and source code hosting providers. The break-in took place between June 14 and June 18. The employees had two-factor login. It relied on codes sent by SMS, and the attacker intercepted them. Reddit disclosed the incident publicly on August 1, 2018 and notified affected users directly. The attacker had read access, and reports say no write access.

What was exposed

Two sets of data were involved. The first was an old database backup covering the period from Reddit's launch in 2005 through May 2007. It held usernames and salted, hashed passwords. It held email addresses too, plus every post and private message from that period. Reddit said people who signed up after 2007 were not in that backup.

The second was email digest data from June 2018. Each digest ties a username to the email address it was sent to. It also lists suggested posts from subreddits the person follows. The attacker also saw source code and internal logs. Reddit didn't publish a count of affected accounts.

Why the timing matters

The gap between the intrusion in June and the public disclosure on August 1 was about six weeks. Reddit said it spent that time confirming what had been accessed. If you changed your password after August, you were protected from the hashes in the backup. If you never did, the old password is still the weak point.

Reddit's own conclusion was blunt: SMS codes are a weaker second factor than it had assumed. Anyone can be targeted this way, because the attack goes through the phone carrier, not through the person.

What that lets criminals do

A salted, hashed password isn't readable, but old hashes can be cracked, and simple passwords go first. If you still use a password from before 2007 anywhere, that's the main risk. The email link is a second one: an address tied to a username lets someone connect an anonymous account to a real mailbox. That helps with phishing. It also helps with unmasking.

The company's response

Reddit reported the breach to law enforcement and reset passwords for people in the old backup, then emailed them. It rotated its secrets and API keys. It also said it was moving its staff from SMS to token-based two-factor login, because SMS proved the weak link.

What to do

Change your Reddit password if you've had an account since the early days, and change it anywhere you reused it. Turn on two-factor login with an authenticator app instead of SMS. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak. It can't remove data from a breach, so the steps below are the practical protection.