The best part of Reddit’s breach: someone spoke up
An employee fell for a fake login page, then reported it right away. That’s the culture to build.
Reddit disclosed this month that an employee entered their password and 2FA code on a convincing fake version of its internal login page. The attacker got into some internal documents, code and dashboards.
The detail I like: the employee reported it themselves, quickly, and the security team cut off access and contained it. Reddit said so publicly, without blaming anyone.
That’s the real lesson. Anyone can be fooled by a good phishing page on a busy day. What decides the damage is the next ten minutes.
How to get there:
- Make reporting easy: one button in the mail client, one chat channel, one phone number.
- Never punish the person who reports. Thank them, in public if they agree.
- Have the response ready: who resets passwords, kills sessions and checks logs, at any hour.
- Move to phishing-resistant MFA such as security keys, which don’t work on fake domains at all.
Shame makes people hide mistakes. Hidden mistakes become breaches.