Reddit Ads support is leaking PII and actively crossing user sessions
7 points
2 hours ago
| 1 comment
| HN
I have been dealing with a Reddit Ads account issue over the last week, and it has quickly escalated into a severe privacy and security red flag. It appears their customer support tools (or the agents themselves) are actively bleeding PII and crossing user sessions entirely.

Over the last week, I have experienced three separate incidents in their live chat:

Incident 1: Account Cross-Contamination (Feb 14) While chatting with an agent (Sonam B), they managed to associate my personal email to a completely unrelated, bizarrely named ad account ("No Panties Games Ad Account"). When I pointed out they were pasting data related to someone else's account alongside my email, they tried to brush it off as an "error" and told me to "kindly ignore."

Incident 2: Direct PII Leak (Feb 20) Today, while following up on the issue with a different agent (Naheeda M), they inexplicably dropped the email address (info@REDACTED.com) and the full legal business entity name of an entirely different advertiser into our chat.

Incident 3: Total Session Confusion and Misattribution (Feb 20) Just minutes later in that same chat, things got much worse. While I was clearly logged into my own account, the agent told me: "The ad account you're currently signed into is u/TeorREDACTED, and ads are getting published with this username. Is that correct?"

This is no longer just a clipboard issue. This strongly suggests a severe backend mapping failure in their support dashboard (Zendesk/Salesforce or an internal admin tool) that is completely misattributing active sessions, user accounts, and ad publishing data.

If their support agents are seeing me as logged into someone else's account and claiming ads are publishing under that username, it raises massive questions: 1. Are agents making changes to other people's ad campaigns thinking it's my account? 2. Is ad spend being billed to the wrong accounts? 3. Who is currently seeing my billing details, legal name, and campaigns?

Given how broken their Tier 1 tools appear to be right now, I wanted to raise the flag here immediately. Has anyone else running Reddit Ads noticed their support agents leaking data or confusing accounts recently?

toomuchtodo
2 hours ago
[-]
https://www.cisa.gov/reporting-cyber-incident at the federal level, if you have a state regulator where PII is in scope, report to them too. Document everything for your complaint as evidence. A GitHub Gist collecting your documentation, archived by the Wayback Machine is an effectively public timestamp mechanism if relevant.
reply