No noble thieves in data security
Reddit’s planned API (application programming interface) changes have been met with a flurry of outrage online, seemingly none more so than the hackers who decided to take matters into their own hands. Earlier this year, the BlackCat ransomware group hacked into Reddit servers and stole 80GB of sensitive data, accessing internal documents, codes, dashboards and business systems.
Biding their time since the breach, the bad actors have now gone public with a demand for a ransom payment and for Reddit to alter course with the planned API pricing changes. Otherwise, the stolen data will be published. This has been a hot button topic in recent weeks, with various subreddits participating in blackouts for a day or so to protest the new policy. Curiously, the hackers’ latter request was only triggered upon Reddit’s failure to pay the initial ransom. It makes one wonder just how serious they were in their supposedly ‘principled objection’, rather than simply exploiting existing user anger at Reddit to paint themselves in a positive light. It doesn’t really make them honorable thieves to try positioning themselves behind a “worthy” cause if they’re still compromising the security of users’ data.
Initial reports from Reddit denied the possibility of the hackers accessing live production systems or user account accounts, though BlackCat still seems confident in the potency of their ill-gotten breach gains. What they are teasing now is data such as user stat tracking, shadowbans and other censorship measures in general.
Whether this breach has any further impact aside from giving more fuel to Reddit protesters remains to be seen. People should, of course, still be concerned about the vulnerabilities inherent in such a massive platform that could lead to their personal data being compromised by intruders with a mind to do so.
BlackCat is only one of the major ransomware groups out there causing havoc. Another is known as Clop, for which the US State Department has just offered a $10 million bounty in exchange for any information. This gang has made recent news for going after federal agencies, including the Department of Energy and Department of Agriculture. In these cases it was a third-party vendor vulnerability at fault, file transfer software known as MOVEit Transfer. Both departments confirmed compromised data.
The fight against cyber criminals never abates, it only takes steps forward – or, if you’re negligent, backward. Avoid negligence, but keep your level of data risk negligible.