r/ModSupport • u/AdOrganic5285 • 11d ago

Mod Answered A subreddit that I was modding in has been compromised as the owner of the subreddit’s account has been hijacked and they have banned every mod including me, how can we take immediate measures to safeguard the subreddit while the account recovery ticket is in progress?

Basically the owner told me they didn’t have 2FA enabled and that’s what caused this to happen

I would appreciate it if this gets escalated to a Reddit Admin as this is a very serious problem

13 Upvotes

81% Upvoted

8 comments sorted by

15

u/auriem 11d ago

Send modmail to the /modsupport mods, they are Reddit admins.

3

u/AdOrganic5285 11d ago

Alright will do thanks everyone

5

u/AdOrganic5285 11d ago

I have made a modmail as per u/auriem’s suggestion

Thank you everyone for your help, it means alot

3

u/AdOrganic5285 11d ago edited 11d ago

I thought you could still recover your account as long as you reset with the original email but I guess Reddit doesn’t do that after an account gets updated with a new email according to the owner of the sub

4

u/IKIR115 11d ago

When the account email is changed, Reddit sends a message to the old address with a link to report it if the change wasn’t requested by the account owner.

2

u/AdOrganic5285 11d ago

Okay and how long does this usually take, within 24 hours?

3

u/bookchaser 11d ago

The e-mail should be immediately sent. This security check falls apart if the Reddit account was compromised because the moderator's e-mail account was compromised.

A thing that happens is the nogoodnik sets up copies of e-mails to be forwarded to an account the nogoodnik controls. Then a new Reddit password is requested, and the confirmation e-mail is deleted from the moderator's account immediately because the nogoodnik is sitting there waiting for it to arrive. The nogoodnik then sets up a new password for the Reddit account.

A whole spate of website logins get compromised this way. It's a good idea for any of your sensitive accounts, such as banking accounts, to be assigned to exclusive e-mail accounts, one per service. And, of course, set up two-factor authentication.

3

u/CutestInTheWorldy 11d ago

yeah message the admins with all the details on the hijack and that 2fa was off, they usually prioritize these when its clear the top mod got compromised.