Reddit must pay a ransom and roll back its API fee hikes, or hackers will leak confidential data.
The BlackCat ransomware gang, also known as ALPHV, posted on their dark web leak site that it stole 80 gigabytes of compressed Reddit data in February.
Reddit spokesperson Gina Antonini declined TechCrunch’s inquiries but verified that BlackCat’s accusations pertain to a cyber attack Reddit confirmed on February 9. Reddit CTO Christopher Slowe, or KeyserSosa, revealed that a “highly-targeted” phishing attempt had compromised employee data and corporate documents. Slowe said the organization has “no evidence” that passwords and accounts were compromised.
Reddit didn’t reveal the attack’s perpetrator. BlackCat admitted to the February infiltration and threatened to release “confidential” material. BlackCat has not revealed what data the hackers stole.
Western Digital was hacked in March and lost 10 gigabytes of data, including customer data, by BlackCat. The same month, the gang threatened to release data allegedly obtained from Amazon-owned Ring.
BlackCat wrote on Saturday, “The Reddit Files,” that it contacted Reddit twice, on April 13 and June 16, but received no answer. In my initial email, I said I would wait for their IPO. This seems ideal! “We are confident that Reddit will not pay for their data,” BlackCat wrote. We expect data leaks.
The hackers want $4.5 million to delete the data and reverse Reddit’s API pricing changes.
Popular third-party Reddit app Apollo has announced it’s closing down due to the new API pricing, and thousands of subreddits went dark last week in protest of the new API policy, including r/music and r/videos.
Reddit denied TechCrunch’s request to react to BlackCat’s demands. In 2018, attackers stole all Reddit data from 2007. This included usernames, hashed passwords, emails, public posts, and private communications.
