Reddit hackers demand $4.5 million ransom and API pricing changes

A ransomware group is claiming responsibility for a hack of Reddit’s systems earlier this year — demanding not just money, but policy changes.

BlackCat, a ransomware group, says it was behind the phishing attack on Reddit in February, as previously reported by Bleeding computer. In a post shared by researcher Dominic Alvieri, BlackCat claims to have stolen 80GB of data from Reddit and is threatening to release it publicly if its demands are not met. The group wishes a $4.5 million payout in exchange for the data and is also demanding that Reddit roll back its planned API pricing changes that spurred user and moderator protests last week.

At the time of the hack, Reddit said hackers had used a “sophisticated and highly targeted” phishing attack to gain access to internal documents and data, including contact information for employees and advertisers. The company claimed that the hackers had not gained access to user data that was not public.

Reddit declined to comment on the record about the hack. Bleeding computer reports that the BlackCat hack and the incident revealed by Reddit in February are the same.

BlackCat’s new demand for API pricing changes follows a contentious back-and-forth between Reddit management and some of its most engaged users. After Reddit announced it would begin charging third-party app developers — potentially to the tune of millions of dollars a year — many top subreddits went dark in response, limiting new posts and closing public access. In an interview with The Verge, Reddit CEO Steve Huffman said the platform was “never designed” to support third-party apps and that the company would not back down from the proposed changes.