The BlackCat ransomware gang threatens to release 80GB of data allegedly stolen from Reddit; the company says BlackCat's claims relate to a February 5 attack
Hackers are threatening to release confidential data stolen from Reddit unless the company pays a ransom demand - and reverses its controversial API price hikes.
Context & Ripple Effects
The episode connects a platform-policy dispute to a data-extortion campaign: BlackCat allegedly used material from Reddit's February intrusion to press both for payment and for a change in API pricing.
Later coverage placed BlackCat behind the Change Healthcare disruption before its site displayed a takedown notice amid exit-scam concerns. That arc matters because a group's public extortion capacity can shift quickly, while the exposure and response burden remains with affected companies.
First-order effects
- Reddit must assess the alleged 80GB cache, validate what data may be exposed, and manage user, partner, and legal communications while BlackCat's release threat remains active.
- BlackCat turns a conventional ransom demand into leverage over Reddit's API policy, seeking to impose a business-policy concession rather than only a payment.
Second-order effects
- The demand puts additional scrutiny on Reddit's API controls and on third parties that access or collect platform data; policy changes can become an attacker's pressure point when stolen material is available.
- A public leak threat raises the cost of incident response for platforms: even without paying, they may need faster disclosure, forensics, and access-control remediation to limit downstream trust damage.
Third-order effects
- If extortion groups increasingly pair stolen data with demands about product or platform governance, cyber risk will be treated less as an IT-continuity issue and more as a constraint on commercial policy decisions.
- The later apparent disruption of BlackCat's public operation shows a countervailing uncertainty: takedowns or criminal-group failures may interrupt a campaign, but do not erase data already taken or the need for victim remediation.
The trend: Ransomware extortion is broadening from demands for money into coercion aimed at the business decisions and public policies of breached platforms.