Hackers from the BlackCat ransomware gang (also known as ALPHV) have threatened to release 80GB of stolen, confidential data from a February 5 cyberattack on Reddit unless Reddit withdraws its recent API price changes and pays $4.5 million to delete the data.
The cybercrime group posted what’s apparently called the “Reddit Files” on its leak site claiming that they’ve already tried contacting Reddit twice — on April 13 and June 16 to no avail. The group hasn’t disclosed the contents of the file yet, only stating that they “took 80 gigabytes (zipped) of data”. From the post’s description, the files seem to have statistics that Reddit tracks about its users, some “interesting confidential data” and how the site silently censors users in addition to other “artefacts from their GitHub”.
Reddit had previously disclosed on February 9 that its systems were hacked on February 5. It was a phishing attack where the threat actors got access to one employee’s credentials and gained access to some internal documents, code as well as some internal dashboards and business systems as explained by Reddit CTO Christopher Slowe in a Reddit post.
Reddit didn’t share much information on the attack back then, saying that the company had no evidence that personal user data had been stolen. Reddit has declined to comment on the validity of BlackCat’s posts. However, BleepingComputer reports having confirmed that BlackCat is indeed behind the February 5 attack on Reddit.
The hackers don’t expect to get paid, as clearly mentioned in the “Reddit Files” post. Considering how Reddit is handling the backlash generated from its skyrocketed API pricing, it seems unlikely that the company will roll back the changes, without a fight anyway.
The API pricing has already caused a lot of disruption on the site, with Reddit going down for a short while as over 7,000 subreddits went private or restricted to protest against the API pricing changes. Reddit CEO Steve Huffman addressed the blackouts in an internal memo saying that they’ll eventually pass and that there’s no significant revenue loss to Reddit from the blackout.
In the News: Indonesia’s largest telecommunication satellite launched by SpaceX
