The company analyzed the security incident for several days already, but there is always a chance that additional evidence is found at a later stage in the investigation. It remains to be seen if Reddit's initial assessment of the security breach holds. The security feature helps, however, when user databases with passwords are copied by attackers, as the attackers would need to obtain two-factor authentication codes from particular users if they manage to break the passwords of the database. LastPass hasnt been compromised in recent hacking scare Home News LastPass hasnt been compromised in recent hacking scare By Manuel Vonau Updated Master passwords were uncovered. If specifically targeted, two-factor authentication does not provide 100% protection. It needs to be noted that two-factor authentication did not prevent the phishing attack against the Reddit employee. The post links to a support article that explains how Reddit users may enable the extra layer of protection on the site. Reddit suggests that users of the site enable two-factor authentication, if they have not done so already. The investigation is still ongoing and Reddit did not provide details on the information that the attacker managed to obtain while having access to company servers. Novem(Credit: LastPass) The data breach LastPass suffered in August enabled a hacker to infiltrate the company again and steal customer information. The attacker could no longer access Reddit systems after the change was made. Reddit's security team changed the status of the account, removing access to systems. The employee who fell for the phishing attack reported the incident to the Security team, according to Reddit 'soon after being phished'. No evidence has been found up to this point that suggests that the attacker managed to gain access to non-public user data, such as email addresses, saved posts or conversations, or the 'Reddit information has been published or distributed'. Investigators of the incident found no evidence that the attacker managed to gain access to 'primary production systems', which hold the majority of data, including Reddit user data. In December, the password-manager maker LastPass revealed that an August breach it had disclosed at the end of November was worse than the company originally thought, compromising encrypted. The campaign used 'plausible sounding prompts' to get employees of the site to a phishing website that looked like the company's intranet gateway.Įmployees who entered their login credentials on that fake website would provide the attackers with the credentials and also second-factor tokens.Īt least one employee of the site feel for the phishing ruse, giving the attacker access to 'some internal docs, code, as well as some internal dashboards and business systems'.

The company became aware of a phishing campaign that targeted Reddit employees specifically on February 5, 2023.

Lastpass breach reddit