Reddit announced on Wednesday that a hacker broke into its computer systems in June, gaining access to the email addresses of some of its users and a database of usernames from 2007.
The company did not say how many users may have been affected. But those affected will soon receive a message from Reddit alerting them of the intrusion, the company said. The 2007 database contained usernames, email addresses, Reddit user posts and private messages. Reddit said it is resetting passwords on these early accounts in which the log-in credentials may still be working. Users who signed up after 2007 were not affected by this part of the data breach.
The hacker also accessed Reddit logs that contained email digests sent between June 3 and June 17. The digests are short selections of popular posts recommended to users based on the subreddits they subscribe to. But the logs also connected usernames with their associated email address. Reddit said that if a user doesn't have an email address tied to their account or had selected not to receive email digests, then they are not affected by this aspect of the breach. Otherwise, the company recommends that users search their inboxes for emails sent by noreply@redditmail.com between June 3 and June 17 to learn if they were affected.
For users whose account credentials were compromised, Reddit will force a password reset. Those users are also encouraged to think about whether they use that password on other sites. And for users whose email addresses were accessed through the email digest, Reddit said, "think about whether there's anything on your Reddit account that you wouldn't want to be associated back to that address." The company also included instructions for users to remove their Reddit data.
The attack began after hackers targeted some Reddit employees between June 14 and June 18, compromising their accounts with Reddit's cloud and source code hosting vendors, the company said. Reddit discovered the intrusion on June 19.
