Posted by x______________ 7 hours ago
Tell HN: Scribd Breached
Subject: Notice of Security Incident
This notice is being sent on behalf of Scribd, Inc., the parent company of Scribd, Slideshare, Everand, and Fable, by Epiq, Scribd Inc.’s notification partner.
Hello,
We are writing to let you know that Scribd, Inc. recently experienced a security incident that may have affected your data.
We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history (not including credit card details).
We have no evidence that this data has been misused, but we are notifying you out of an abundance of caution so that you can take steps to protect your information.
Watch for phishing
We encourage you to stay vigilant for phishing attempts by bad actors pretending to be Scribd, Inc. or Scribd, Slideshare, Everand or Fable.
Remember that Scribd, Inc. will never ask you for your username and password or other sensitive information via email or text. If you did receive a message like that:
Don't click on any links in it. Instead type scribd.com, slideshare.net, everand.com, or fable.co directly into your browser.
Call us at: +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m., Central European Time.
Report it through Scribd, Inc.'s Help Center.
We regret that this incident occurred and any concern it may cause you. If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time.
The National Cyber Security Center has helpful guidance on how to recognize and avoid phishing scams here.
What Scribd, Inc. is doing
We have secured the affected system and ended the unauthorized access.
We have notified law enforcement as well as the relevant data protection authorities.
We are working with an expert third party cybersecurity firm to strengthen our access controls and monitoring.
Scribd, Inc.
All this will tend to get blamed on AI, but AI didn't put these vulnerabilities into place. AI is just a tool that can be used to discover vulnerabilities, and the only question we have to answer is whether or not that tool should be available to regular people.
Some will try to frame the question as being about whether we should allow AI aid in cyber-security, but that's not the question. This technology isn't going away. The bad guys will have it. Nations will have it. Again, the question is, can regular people also continue to have it?
Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.
Most major countries have this kind of programs. Those could probably be bigger and they will always miss obvious stuff but they exist, at least for CNI.
They are. Most critical infrastructure providers worldwide have in house or contract red teams. Every western government has an agency dedicated to cyber defense and they all have red team programs.
I see hope in what happened during the blackout in Spain/Portugal.
But essentially, with the power down, people came out as a community and life went on without technology. Granted, the power came back within a day, but I have confidence that they would have found a way.
Losing electricity causes significant disruption, emergency generators have to turn on for hospitals, the transport system stops.
The BBC is not what it once was, so assume it is no better than any other outlet in wanting to create a narrative.
The actual reality on the ground for many people would have been far from the whimsical event the BBC portrays.
Emergency blackouts are a disruption for sure and I believe people were injured in that event, but the lesson I took from it is that nothing is more reliable than community. Technology comes and goes, but we will always have each other.
0 https://news.ycombinator.com/item?id=5493280 Scribd hacked – emails and hashed passwords leaked (scribd.com) 106 points by joosters on April 4, 2013 | hide | past | favorite | 65 comments
1 https://thenextweb.com/news/scribd-reveals-it-was-hacked-thi...
2 https://web.archive.org/web/20130407114005/https://support.s...
Notable callouts from 2013: "Our investigation indicates that no content, payment and sales-related data, or other information were accessed or compromised. We believe the information accessed was limited to general user information, which includes usernames, emails, and encrypted passwords."
"We take our responsibility to protect our users' data extremely seriously and constantly improve our security infrastructure and policies. Following this incident, we have implemented numerous additional safeguards. Not only have we taken steps to address the specific issues that led to this incident, but we are also conducting a comprehensive security review and are implementing more general measures to proactively enhance security. We are also alerting relevant authorities to the matter and will co-operate with their investigation."
And they posted about a security incident on their blog on Oct 1. https://support.scribd.com/hc/en-us/articles/53787421531284-...
>Why not tell all customers at once, especially if payment information was involved?
Answered in the article!
“Q: Am I affected? How will I be notified?
A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet“
And also..
"Q: Where can I find the latest updates?
A: The latest updates regarding the incident will be made available on this page.“
..."Updated October 01, 2026 19:29"
For a site where you find data, they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared.
> A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet
That doesn't answer why they are doing it in phases.
Correct!
“they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared“
Call them up!
And also, that this is over.