Reddit鈥檚 month may be going from bad to worse.
Hackers from the BlackCat ransomware gang, also known as ALPHV, are threatening to leak 80 gigabytes of confidential data from Reddit that they claim to have stolen during a February breach, according to a post from the group on the dark web, which was reviewed by CNN and an independent cybersecurity expert.
In their post, the hackers claim they first demanded a US$4.5 million payout 鈥渇or the deletion of the data and our silence鈥� in April. After receiving no response, the group said it followed up on Friday with an additional demand: Reddit should withdraw a controversial new pricing policy that has sparked a protest from some of the platform鈥檚 most influential users.
Reddit CTO Chris Slowe previously posted about a security incident that took place in early February. In the post, Slowe said the company鈥檚 鈥渟ystems were hacked as a result of a sophisticated and highly-targeted phishing attack,鈥� with hackers accessing 鈥渟ome internal documents, code, and some internal business systems.鈥� Only employee data was accessed, according to the post.
A Reddit spokesperson confirmed to CNN on Monday that BlackCat鈥檚 post relates to the February incident. The spokesperson reiterated that no user data was accessed, but declined to comment beyond that.
More than 6,000 Reddit forums went dark last Monday in what was supposed to be a two-day protest over the company鈥檚 plan to begin charging steep fees for some third party apps to access its platform. A week later, more than 3,500 Reddit forums remain dark.
While the ransom note appears to support the protestors鈥� cause, some experts are skeptical of BlackCat鈥檚 actual motives.
鈥淚 suspect that ALPHV doesn鈥檛 actually care about the API pricing. They simply want future victims to see how much ongoing harm they can cause to increase the likelihood of them deciding that payment is the least painful option,鈥� said Brett Callow, threat analyst at cybersecurity firm Emsisoft, who reviewed the post on the dark web.
BlackCat, for its part, said it does not expect Reddit to meet its demands.
鈥淲e are very confident that Reddit will not pay for its data,鈥� the group wrote in the post on the dark web. 鈥淲e expect to leak the data.鈥�
