Reddit employee phished via cloned intranet gateway
On February 5, 2023 attackers sent Reddit employees prompts pointing to a site that cloned Reddit's intranet gateway, built to capture both passwords and second-factor codes. One employee entered credentials and a code, and the attacker reached internal documents, code, dashboards and business systems before the employee self-reported. Reddit disclosed on February 9, 2023.
- Victim
- Industry
- Media and streaming
- Country
- United States
- Intrusion began
- Feb 5, 2023
- First disclosed
- Feb 9, 2023
- Actor
- Unattributed
- Initial access
- Credential phishing
- Identity control that failed
- Authentication
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
One-time codes can be phished along with the password. Phishing-resistant MFA (FIDO2 or passkeys bound to the real domain) would have failed on the cloned site.
Sources
- We had a security incident. Here's what we know., Reddit (r/reddit), Feb 9, 2023
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Dexcom internal documents accessed after targeted vishing 2026 · Credential phishing
- ASOS customer data reached with an employee login obtained by impersonation 2026 · Credential phishing
- RingCentral customer data stolen after a social engineering attack 2026 · Credential phishing
- Mixpanel smishing breach exposes OpenAI API user data 2025 · Credential phishing
Cite this record
SWI Community Team. (2026). Reddit employee phished via cloned intranet gateway. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2023-reddit-employee-phishing/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.