Reddit hackers demand $4.5M and ethical behavior from the company

According to a recent tweet by cybersecurity analyst and security researcher Dominic Alvieri, a cybercrime group known as BlackCat (also known as ALPHV) has threatened to release 80GB of compressed files stolen from Reddit during the February 2023 security breach. data.

The group is demanding a $4.5 million ransom and a reversal of recent API pricing changes.

While the report doesn't specify the payment method requested, the groups will almost certainly request cryptocurrencies -- usually in the form of Monero (XMR) or Bitcoin (BTC).

Reddit confirmed the breach earlier this year, allowing hackers to access internal documents, code and business systems, but there is no evidence that user accounts were compromised or production systems were compromised.

The BlackCat group's demands were made public via a post on its leak site, a common tactic used by ransomware groups to pressure victims.

Dominic Alvieri, a cybersecurity analyst and security researcher, shared screenshots of the group's request on Twitter. Despite being a ransomware group, BlackCat did not encrypt any devices during this attack, but it did leak a lot of data. The exact details of the stolen data have not been disclosed.

According to the group's post, they successfully compromised Reddit's servers on February 5, 2023, and extracted 80GB of compressed data.

It's unclear whether that number refers to the compressed or uncompressed data size. The group claims to have contacted Reddit on April 13 and June 16, requesting a payment of $4.5 million to delete the data. They also warned that they would demand reversal of the API pricing changes if the extortion must be made public.

It is highly unlikely that Reddit will comply with these requirements. BlackCat appears to be capitalizing on the media attention Reddit is currently receiving from a blackout in protest of API pricing. Ransomware attackers often seek public attention and media coverage, contrary to criminals' usual preference to avoid attention.

If BlackCat does publish the stolen Reddit data, it is unlikely to contain user data such as account details, passwords or payment information.

Reddit has always maintained that the production systems holding such data were not compromised. Instead, BlackCat hinted at disclosing "all the statistics they track about users," as well as data about how Reddit "silently censors users."

While it's uncertain to what extent Reddit users will care about shadow bans and stalking systems, this could fuel further protests against the platform.

As of now, Reddit has not confirmed any statements made by the criminal gang regarding the ransom request and the type of data they claim to have. We will provide an update as more information becomes available.