Reddit Breach Highlights Limits of SMS-Based Authentication
Summary: Reddit disclosed on August 1, 2018 that an attacker compromised several employee accounts at its cloud and source code hosting providers between June 14 and 18, exposing internal source code plus email addresses and obfuscated passwords for users who registered before May 2007. Reddit said the employee accounts were protected by SMS-based two-factor authentication, but the intruder intercepted that second factor, and the company stated the main attack was via SMS intercept.
What's compelling: Reddit's breach turned on a second factor its employees believed was protecting them, and the article notes Google now requires security keys for all 85,000+ employees with no confirmed account takeovers since early 2017 - the gap between those two postures is the exposure a security leader has to account for.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026