2016 Mass Password Reset After a Credential-Stuffing Surge

In 2016 Reddit locked down a large group of accounts and forced password resets after detecting a credential-stuffing campaign in which attackers replayed username-and-password pairs stolen from unrelated breaches, including older leaks such as LinkedIn's. The activity was not a breach of Reddit's own systems; it exploited users who reused passwords across sites. Admins told affected users their accounts had been locked due to anomalous activity suggesting unauthorized access, and that they would have to reset their passwords to regain entry. Reddit initially told some users their accounts were 'suspended' before clarifying they were only locked as a precaution. The company urged users to choose unique passwords and enable two-factor authentication.