Tell HN: Scribd Breached

Not seeing anything posted about this anywhere, received on Monday, 26th of Oct 2026:

Subject: Notice of Security Incident

This notice is being sent on behalf of Scribd, Inc., the parent company of Scribd, Slideshare, Everand, and Fable, by Epiq, Scribd Inc.’s notification partner.

Hello,

We are writing to let you know that Scribd, Inc. recently experienced a security incident that may have affected your data.

We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history (not including credit card details).

We have no evidence that this data has been misused, but we are notifying you out of an abundance of caution so that you can take steps to protect your information.

Watch for phishing

We encourage you to stay vigilant for phishing attempts by bad actors pretending to be Scribd, Inc. or Scribd, Slideshare, Everand or Fable.

Remember that Scribd, Inc. will never ask you for your username and password or other sensitive information via email or text. If you did receive a message like that:

    Don't click on any links in it. Instead type scribd.com, slideshare.net, everand.com, or fable.co directly into your browser.
    Call us at: +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m., Central European Time.
    Report it through Scribd, Inc.'s Help Center.

For more information

We regret that this incident occurred and any concern it may cause you. If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time.

The National Cyber Security Center has helpful guidance on how to recognize and avoid phishing scams here.

What Scribd, Inc. is doing

    We have secured the affected system and ended the unauthorized access.
    We have notified law enforcement as well as the relevant data protection authorities.
    We are working with an expert third party cybersecurity firm to strengthen our access controls and monitoring.

We value the trust you place in us with your information, and don’t take that lightly. We are deeply sorry this happened and will keep you updated if anything further changes.

Scribd, Inc.

Comments

Comment by Buttons840 3 hours ago

I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure, just to ensure it's not too easy, but probably this isn't happening because it would be a felony to even try. The bad guys are free to try though.

All this will tend to get blamed on AI, but AI didn't put these vulnerabilities into place. AI is just a tool that can be used to discover vulnerabilities, and the only question we have to answer is whether or not that tool should be available to regular people.

Some will try to frame the question as being about whether we should allow AI aid in cyber-security, but that's not the question. This technology isn't going away. The bad guys will have it. Nations will have it. Again, the question is, can regular people also continue to have it?

Comment by parable 1 hour ago

As someone who has helped to secure critical national infrastructure several years ago, I can say that it was a mess to disclose the vulnerabilities I identified, and in some cases it took years to patch them. Some of these vulnerabilities were RCEs and mass PII leaks. It's simply not worth the risk for most people - who aren't in the USA - to bother doing this sort of security research. However, if you are in the USA, there are provisions in the CFAA that enable good-faith security research to take place (https://www.justice.gov/archives/opa/pr/department-justice-a...), so to the best of my understanding, you're able to do good-faith research without being charged or prosecuted, and you should take advantage of this if you have the skills or models to do so. I am not based in the USA, and there are no laws in my country that guarantee me zero jail time for simply trying to do the right thing, so I am not incentivized to continue finding vulnerabilities in my country's infrastructure.

Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.

Comment by cpa 2 hours ago

It is absolutely happening, paid by your taxpayer dollars (if you’re American).

Most major countries have this kind of programs. Those could probably be bigger and they will always miss obvious stuff but they exist, at least for CNI.

Comment by Melatonic 25 minutes ago

Don't worry - Siri is on it - that's actually why they've been so lacklustre. Just too busy hacking for the good guys

Comment by mike_d 48 minutes ago

> I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure

They are. Most critical infrastructure providers worldwide have in house or contract red teams. Every western government has an agency dedicated to cyber defense and they all have red team programs.

Comment by aslilac 2 hours ago

imagine if we just turned off 90% of the non-critical internet for two weeks, hardened up in an absolute mad dash where everyone has access to top tier cyber models, and then afterwards we go back to business as usual. it’d be a disaster short-term but long-term would it be worse than the years of slow drip we’re about to go through? idk! I kinda think it’d be interesting to find out!

Comment by AlecSchueler 2 hours ago

Imagine if everyone had just stayed at home for a week in 2020.

Comment by mmwelt 12 minutes ago

Everyone would be very difficult. You'd still need some people to make sure essential services are still functioning, and that still involves quite a large number of people.

Comment by jtolmar 52 minutes ago

It'd take more than a week, but even now, if the whole world coordinated a simultaneous quarantine, we'd eliminate covid, the flu, the common cold, and a thousand nameless respiratory cruds.

Comment by fyredge 1 hour ago

That was my first thought as well. With COVID, we recognised that WFH was viable for white collar work. Perhaps a global 2 week cleanse will allow everyone to re-evaluate life priorities outside of the internet.

I see hope in what happened during the blackout in Spain/Portugal.

Comment by mentalgear 1 hour ago

what happened there ?

Comment by bertylicious 54 minutes ago

I think they are referring to the reports of people suddenly meeting on the streets and hanging out together back then.

Comment by fodkodrasz 1 hour ago

Nothing, I guess, and that is a good thing, I guess: the world didn't even by a day (few days?) without electricity.

Comment by AspireOne 2 hours ago

Regular people are often bad guys too, you know. If the reality was "bad guys will have it. Should regular people too?" The entire core dilemma would be entirely eliminated lol.

Comment by 1317 19 minutes ago

So if someone's got into their systems can they put a dump of all the PDFs up somewhere?

Comment by x______________ 58 minutes ago

Seems Scribd made the news 13 years ago for the same issue[0] [1] and an archive.org link of the original-now-deleted announcement[2]!

0 https://news.ycombinator.com/item?id=5493280 Scribd hacked – emails and hashed passwords leaked (scribd.com) 106 points by joosters on April 4, 2013 | hide | past | favorite | 65 comments

1 https://thenextweb.com/news/scribd-reveals-it-was-hacked-thi...

2 https://web.archive.org/web/20130407114005/https://support.s...

Notable callouts from 2013: "Our investigation indicates that no content, payment and sales-related data, or other information were accessed or compromised. We believe the information accessed was limited to general user information, which includes usernames, emails, and encrypted passwords."

"We take our responsibility to protect our users' data extremely seriously and constantly improve our security infrastructure and policies. Following this incident, we have implemented numerous additional safeguards. Not only have we taken steps to address the specific issues that led to this incident, but we are also conducting a comprehensive security review and are implementing more general measures to proactively enhance security. We are also alerting relevant authorities to the matter and will co-operate with their investigation."

Comment by smurda 4 hours ago

I only received this same email a few hours ago, Oct 30. Why not tell all customers at once, especially if payment information was involved?

And they posted about a security incident on their blog on Oct 1. https://support.scribd.com/hc/en-us/articles/53787421531284-...

Comment by x______________ 1 hour ago

The email received is a rehash of the linked article, nice find.

>Why not tell all customers at once, especially if payment information was involved?

Answered in the article!

“Q: Am I affected? How will I be notified?

A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet“

And also..

"Q: Where can I find the latest updates?

A: The latest updates regarding the incident will be made available on this page.“

..."Updated October 01, 2026 19:29"

For a site where you find data, they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared.

Comment by edoceo 4 hours ago

[dead]

Comment by vrotaru 1 hour ago

It looks like we all enjoyed "Security through obscurity", where obscurity was referring to existing vulnerabilities.

And also, that this is over.

Comment by parable 1 hour ago

Please forgive my stupidity, but is there any particular reason why companies never seem to disclose what "system" of theirs was breached? If this breach came about as a result of a security incident at a third-party, would it not benefit everyone minus the vendor to shift the blame? I understand that they say "our systems", but I've seen companies say this before when what they mean is "a system controlled by a vendor we contracted".

Comment by neya 3 hours ago

Scribd is the most predatory site that steals people's content and then doesn't honor their promise (upload a PDF to download one..oops that one doesn't qualify, but we will keep your copy!). Fuck em, they built their entire model on predatory behaviour towards broke college students, hope they burn to the ground.

Comment by rememo42 48 minutes ago

How do we even know which credit card is affected by this if we want to cancel it?

Comment by x______________ 2 minutes ago

>How do we even know which credit card is affected by this if we want to cancel it?

"If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time."

Comment by reassess_blind 1 hour ago

I run a few small scale SaaS products. This is a scary time.

Comment by paaloeye 3 hours ago

https://news.ycombinator.com/item?id=50313197

Comment by paaloeye 3 hours ago

> We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card expiry date.

Comment by bluecode 4 hours ago

No one is safe anymore.

Comment by dlt713705 1 hour ago

No one has ever been safe. I would rephrase it as: "More and more people are becoming aware of their exposure".

Comment by Razengan 4 hours ago

Hide yo apps, hide yo websites, hide yo hosts

Comment by totetsu 3 hours ago

How long until we all get cyber-war fatigue and this isn't even news anymore.

Comment by Razengan 3 hours ago

Man, people stopped caring about all the leaks and breaches and dark web data sales over 10 years ago

Comment by Avicebron 3 hours ago

Is resignation because nothing was ever fixed or done about it because it wasn't "economically viable" considered not caring?

Comment by Razengan 3 hours ago

Until the people in power start going to jail or losing their jobs, instead of just paying fines as "the cost of doing business" from the company accounts, probably nothing will be fixed

Comment by 1 hour ago

Comment by Beez2Fancy 1 hour ago

U WIN @ teh internetz comments 2 nite. congrats!

Comment by 1 hour ago

Comment by collabs 4 hours ago

I don't see any email like this in my inbox. Perhaps they are only sending this email to those who have their payment information saved on Scribd?

Comment by x______________ 1 hour ago

> I don't see any email like this in my inbox.

They stated that they're doing a staggered rollout for email notifications which states at the beginning of October with other users reporting receiving the email yesterday[0].

0 https://news.ycombinator.com/item?id=50313006

Comment by kooi 3 hours ago

Not a security person, but are there standards for PII encrypted at rest?

Surely this is common? Surely?

Comment by mirashii 2 hours ago

This is a common sentiment, but the security story isn’t so clear cut as that. Encrypted at rest really just means that if you yank the disk out of the server, an adversary can’t read it. But if it’s a system that is online serving a database and you gain access to the application reading from the database, encryption at rest doesn’t save you. It’s obvious the application server must be able to read the decrypted data. If an adversary breaches the application, they get the data.

Comment by waste_monk 1 hour ago

>It’s obvious the application server must be able to read the decrypted data

Interestingly, that's not true. Homomorphic encryption can let you perform the same operations on encrypted data as on the plaintext, with the same results once decrypted. But it's vastly slower and less efficient - I know there are libraries like Microsoft SEAL but I've never seen anything that uses it in practice.

Comment by cuu508 1 hour ago

Let's say the application is storing user's phone number so it can send SMS notifications to the user. Encrypt it all you want, but when it is time to send the SMS you will need the phone number in plaintext so you can pass it to the SMS gateway.

Comment by 8cvor6j844qw_d6 3 hours ago

Did some exploit get disclosed? HN frontpage is spammed with breaches.

Comment by wafflemaker 7 minutes ago

Maybe the Cursor IDE compromise? It might be what got Binance. And it made a lot devs machines backdoored between Wednesday 28th Oct and whenever people decide to remove the backdoor from their machines.

Comment by ipsum2 3 hours ago

The exploit is called AI (or LLMs)

Comment by isatty 3 hours ago

You’re saying sribd has actually worked for people? I just ignore it in my searches and just find the pdf elsewhere.

Comment by x______________ 1 hour ago

> I just ignore it in my searches and just find the pdf elsewhere.

In retrospect, this was the correct way to proceed.

The docs I found were content, but nothing that could be used for its original purpose. Splurging a monthly subscription to find out sucked, but being breached and getting my info stolen is a kick in the ass.

Comment by paaloeye 3 hours ago

I'm wonder how many users are exposed

Comment by engineer_22 3 hours ago

Nice, I've been trying to hack scribd to download a pdf all day

Comment by xvector 1 hour ago

It's so interesting seeing all of these breaches and then going back to the old threads on Mythos and seeing the widespread skepticism and denial on HN.

Comment by pquigley 3 hours ago

[flagged]

Comment by PeterHolzwarth 3 hours ago

@dang, always been curious about this: why are posts like this grey text vs dark test? It's difficult to read, being so low-contrast. I assume it's based on numbers, the poster, up/downvotes etc - but it seems a poor use of those systems given it sacrifices readability. Is it just a light mode thing? Is it just me?

Comment by avree 3 hours ago

As far as I know this is a relic from the PG days. It was done to keep the focus on URL based submissions, and avoid people using the platform as a text/blogging platform (at the time, Reddit was rising, and self posts there were already very common.) URLs were dark, text was meant to support the URL and was lighter.

I think the color actually got lightened a few times.

Comment by Sn0wCoder 2 hours ago

Was the text light grey before you clicked the comments? Typically the link turns from almost black to light grey after you visit the site, just like a normal link will turn from blue to purple after you click the link to indicate you have visited the site. In this post for example the link goes to the 'Tell HN:' so the link goes directly to the comments. Could it be you did not pay attention until you had visited the comments once already??

Comment by PeterHolzwarth 1 hour ago

It's been 22 mins since I left my comment - the original post is still light grey (that doesn't mean much, but as this post accumulates upvotes, I don't yet see any change in test color).

Comment by Barbing 1 hour ago

It’s way, way too low contrast.

Edit: “@dang” apparently doesn’t ‘work’, but emailed this to hn@ycombinator.com

Comment by dozerly 3 hours ago

I always assumed it was the down arrow affecting it, but I have always giggled at the fact that people with sharp eyes have to endure the bad posts while others do not

Comment by vigilantpuma 1 hour ago

I think that’s true for comments but not posts.

Comment by jacquesm 3 hours ago

[flagged]

Comment by TZubiri 4 hours ago

Wonder if there's anything of worth.

Hackers got their hands on a loot of 300k pirated book pdfs? And internal documents that were already leaked by someone that googled "how to share a pdf".

Comment by coldfloor 4 hours ago

Geez, I know nobody here clicks through and reads articles before commenting, but are we not even reading the posts now?

>we found that the third party may have accessed your email address... last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history

Comment by TZubiri 4 hours ago

not even worth disclosing nowadays, almost entirely public info

Comment by derwiki 4 hours ago

Great reason to use privacy.com virtual cards wherever possible and online

Comment by parable 1 hour ago

This is good advice for anyone who lives in the USA, but there are hardly any adequate alternatives for the rest of the world, as far as I know.

Comment by x______________ 1 hour ago

OP> Great reason to use <...> virtual cards wherever possible and online

> but there are hardly any adequate alternatives for the rest of the world, as far as I know.

Maybe start with your bank?

My local (Central European) bank offered virtual cards service yesterday to which I declined setting them up on site, will strongly reconsider now, thanks!

Comment by parable 1 hour ago

My bank is the opposite of yours. They used to offer a similar service but shuttered it a few years ago. A shame.

Comment by tjwebbnorfolk 3 hours ago

yea, until privacy.com gets hacked

Comment by aliasxneo 3 hours ago

What would they do with my bank account and routing number?

Comment by AdieuToLogic 3 hours ago

> What would they do with my bank account and routing number?

Use it for money laundering and fraud.

Comment by fnord77 4 hours ago

I don't even think they actually pirated book pdfs. Just previews to get you to sign up that lead to no where

Comment by LordGronk 3 hours ago

Scribd has a ton of oop but copyrighted licensed content, which I highly doubt they pay licensing fees for.