Posted by x______________ 9 hours ago
Tell HN: Scribd Breached
Subject: Notice of Security Incident
This notice is being sent on behalf of Scribd, Inc., the parent company of Scribd, Slideshare, Everand, and Fable, by Epiq, Scribd Inc.’s notification partner.
Hello,
We are writing to let you know that Scribd, Inc. recently experienced a security incident that may have affected your data.
We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history (not including credit card details).
We have no evidence that this data has been misused, but we are notifying you out of an abundance of caution so that you can take steps to protect your information.
Watch for phishing
We encourage you to stay vigilant for phishing attempts by bad actors pretending to be Scribd, Inc. or Scribd, Slideshare, Everand or Fable.
Remember that Scribd, Inc. will never ask you for your username and password or other sensitive information via email or text. If you did receive a message like that:
Don't click on any links in it. Instead type scribd.com, slideshare.net, everand.com, or fable.co directly into your browser.
Call us at: +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m., Central European Time.
Report it through Scribd, Inc.'s Help Center.
We regret that this incident occurred and any concern it may cause you. If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time.
The National Cyber Security Center has helpful guidance on how to recognize and avoid phishing scams here.
What Scribd, Inc. is doing
We have secured the affected system and ended the unauthorized access.
We have notified law enforcement as well as the relevant data protection authorities.
We are working with an expert third party cybersecurity firm to strengthen our access controls and monitoring.
Scribd, Inc.
I think the color actually got lightened a few times.
Edit: “@dang” apparently doesn’t ‘work’, but emailed this to hn@ycombinator.com
Hackers got their hands on a loot of 300k pirated book pdfs? And internal documents that were already leaked by someone that googled "how to share a pdf".
>we found that the third party may have accessed your email address... last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history
> but there are hardly any adequate alternatives for the rest of the world, as far as I know.
Maybe start with your bank?
My local (Central European) bank offered virtual cards service yesterday to which I declined setting them up on site, will strongly reconsider now, thanks!
Maybe a good time to call up the bank (or other banks) and ask them if they provide this or any other service that would prevent you from needing to cancel physical cards in case of these ever-increasing security incidents?
Late edit: just checked it out and the virtual cards can be ordered via the banking app, either permanent virtual or one-time use where the card auto-expires after the purchase has gone through. That's really neat! (Not gloating but sharing what I've learned, hope you can find similar security in your bank offerings).
I doubt I'll have any influence on the products any one bank in my country offers, but it doesn't hurt to ask.
Use it for money laundering and fraud.