Reddit 2018 Breach: Attacker Bypasses SMS-Based 2FA, Exfiltrates 2007 Database Backup

Reddit disclosed on August 1, 2018, in an r/announcements post by CTO Christopher Slowe (username KeyserSosa), that an attacker had compromised several employee accounts between June 14 and June 18, 2018. Reddit had discovered the intrusion on June 19. Although the affected staff accounts were protected by two-factor authentication, the attacker defeated it by performing an SMS-intercept attack against the employees' phone numbers, capturing the one-time codes sent over text message. This gave the intruder access to Reddit's cloud and source-code hosting providers.

Reddit conceded that 'SMS-based authentication is not nearly as secure as we would hope' and said the incident underscored the need to move from SMS to token-based two-factor authentication. Security journalists seized on the breach as a textbook illustration of the structural weakness of SMS as a second factor: because SMS codes can be intercepted through SIM-swapping, network-level interception, and social engineering of carriers, a phone number is a fundamentally weaker anchor for authentication than a hardware token or an authenticator app. Krebs on Security and others used the episode to argue that high-value enterprise accounts in particular should never rely on SMS.

The most sensitive exposure was a complete database backup from May 2007 that the attacker downloaded with read-only access. It held account credentials — usernames together with salted and hashed passwords — along with email addresses and all content for users active from the site's 2005 launch through May 2007. That content was mostly public posts, but it also included private messages exchanged among those early users. Because the data predated more than a decade of subsequent security improvements, it represented a snapshot of Reddit's earliest community frozen in time and now in an attacker's hands.

Beyond the 2007 backup, the attacker obtained Reddit source code, internal files, logs, and configuration details. The intruder also accessed a set of more recent email-digest logs covering roughly June 3–17, 2018, which paired then-current usernames with the email addresses to which the digests had been sent. This was a meaningful de-anonymization risk for modern users: even though their passwords were not in the 2007 backup, the digest logs could link a contemporary Reddit pseudonym to a real email address.

Reddit emphasized that the attacker had read-only access throughout — they could view and copy data but could not alter Reddit's systems or content. Reddit notified affected users, initiated password resets for accounts whose 2007 credentials might still have been in use, reported the incident to law enforcement, and brought in security experts to investigate.

The 2018 breach became one of the most widely cited case studies in the limits of SMS-based two-factor authentication for both consumer and enterprise contexts. It demonstrated that a determined attacker could defeat 2FA without ever stealing a password directly, simply by intercepting the codes meant to protect it, and it accelerated the broader industry shift toward phishing-resistant authentication methods.