Subject: Notice of Security Incident
This notice is being sent on behalf of Scribd, Inc., the parent company of Scribd, Slideshare, Everand, and Fable, by Epiq, Scribd Inc.’s notification partner.
Hello,
We are writing to let you know that Scribd, Inc. recently experienced a security incident that may have affected your data.
We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history (not including credit card details).
We have no evidence that this data has been misused, but we are notifying you out of an abundance of caution so that you can take steps to protect your information.
Watch for phishing
We encourage you to stay vigilant for phishing attempts by bad actors pretending to be Scribd, Inc. or Scribd, Slideshare, Everand or Fable.
Remember that Scribd, Inc. will never ask you for your username and password or other sensitive information via email or text. If you did receive a message like that:
Don't click on any links in it. Instead type scribd.com, slideshare.net, everand.com, or fable.co directly into your browser.
Call us at: +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m., Central European Time.
Report it through Scribd, Inc.'s Help Center.
We regret that this incident occurred and any concern it may cause you. If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time.
The National Cyber Security Center has helpful guidance on how to recognize and avoid phishing scams here.
What Scribd, Inc. is doing
We have secured the affected system and ended the unauthorized access.
We have notified law enforcement as well as the relevant data protection authorities.
We are working with an expert third party cybersecurity firm to strengthen our access controls and monitoring.
Scribd, Inc.
All this will tend to get blamed on AI, but AI didn't put these vulnerabilities into place. AI is just a tool that can be used to discover vulnerabilities, and the only question we have to answer is whether or not that tool should be available to regular people.
Some will try to frame the question as being about whether we should allow AI aid in cyber-security, but that's not the question. This technology isn't going away. The bad guys will have it. Nations will have it. Again, the question is, can regular people also continue to have it?
Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.
He reported it responsibly and then the governor personally started attacking him and threatening him with a felony.
I checked your link and I see that is a 2022 DoJ policy. How much peace of mind do you think a DoJ policy (not a law) from 2022 gives me?
I read as far as the first sentence: "The policy for the first time directs that good-faith security research should not be charged."
Soooo... the underlying message here is that good-faith security research is technically against the law, but their policy is not to press charges. They clearly consider good-faith security research to be technically against the law, because it wouldn't make sense to say "for the first time, our policy is to NOT charge people who follow the law"--that makes no sense. What they're saying is "we could charge good-faith security researches, but let's not as a matter of policy".
Reading further you see the policy is about NOT prosecuting people who do something like use an alias as their account name. That same paragraph says their focus should be on people who access systems without permission.
And to be clear, I am advocating for red teams that operate without permission. The bad guys are attacking our systems without permission, and I think the good guys should be protected when they do the same for a good purpose.
Here's more detail if anyone wants it: https://www.malwarebytes.com/blog/news/2022/02/journalist-wo...
Decades ago, I met someone at a conference who was red-teaming a NATO country's infrastructure: power plants, water treatment etc.
Said that things had improved dramatically since 1990s nethack days.
But the team had a secret weapon: a young woman in a short skirt with a laptop computer, pretending to be a systems software vendor. The Weapon had been able to compromise every site, had never failed. Never.
They are. Most critical infrastructure providers worldwide have in house or contract red teams. Every western government has an agency dedicated to cyber defense and they all have red team programs.
Most major countries have this kind of programs. Those could probably be bigger and they will always miss obvious stuff but they exist, at least for CNI.
Using that access is the kind of thing that is only done when there's a need and in the case of really critical stuff that can be years in the future - or never.
One could even imagine hyper-critical exploits being shared back to the host. For instance if Russian agents got access to critical nuclear systems (or vice versa), I could imagine leadership warning the other side and getting out of the system entirely in order to maintain the status quo at the expense of pretenders.
I see hope in what happened during the blackout in Spain/Portugal.
But essentially, with the power down, people came out as a community and life went on without technology. Granted, the power came back within a day, but I have confidence that they would have found a way.
Losing electricity causes significant disruption, emergency generators have to turn on for hospitals, the transport system stops.
The BBC is not what it once was, so assume it is no better than any other outlet in wanting to create a narrative.
The actual reality on the ground for many people would have been far from the whimsical event the BBC portrays.
Emergency blackouts are a disruption for sure and I believe people were injured in that event, but the lesson I took from it is that nothing is more reliable than community. Technology comes and goes, but we will always have each other.
> emergency generators have to turn on for hospitals
So, they still have power.
> the transport system stops.
And people have to accept being where they are or find other ways of getting around.
A lot of companies cyber security posture is asking Claude to "find all security issues make no mistakes".
"If you write code as cleverly as you can, you are, by definition, too stupid to debug it."
Do you disagree with this? Because if you don't, then the rate of bugs/RCEs in a completely AI-written-software world will be exactly the same as the rate of bugs in a completely human-written-software world.
A combination of human-authorship + AI-review, with absolutely no AI-written code is going to have the lowest rate of bugs, because there is always one entity who understands the code (because they wrote it) and one entity who is smarter than the author who can find bugs.
The AI-generated code I see from SOTA models is absolute spaghetti, and they start running into problems spotting bugs after even a small number of refinements/changes to the software (say, 50).
The problem with all this spaghetti is that they are quick to write something that even they can't easily read. Even mediocre but experienced humans are not so eager to write something that they can't easily debug.
IOW, for any non-trivial problem, with AI-generated code you are guaranteed to get spaghetti that it cannot understand. With humans, it's only a probability that that will happen.
If you don't have the self-awareness to realise that you are asking the same question as "Can you prove there's no God?", then I'm afraid no proof will ever be sufficient for you.
Asking you to justify a limitation you asserted doesn't mean I cannot be convinced. You're asserting Kernighan's law holds for AI, I'm saying there are other ways to debug than applications of cleverness. Does throwing more attempts at that spaghetti find vulnerabilities even when the thing that wrote it can't easily understand it? I'm not saying AI must be able to do it because you can't prove it can't. I'm asking what supports your claim that it can't.
0 https://news.ycombinator.com/item?id=5493280 Scribd hacked – emails and hashed passwords leaked (scribd.com) 106 points by joosters on April 4, 2013 | hide | past | favorite | 65 comments
1 https://thenextweb.com/news/scribd-reveals-it-was-hacked-thi...
2 https://web.archive.org/web/20130407114005/https://support.s...
Notable callouts from 2013: "Our investigation indicates that no content, payment and sales-related data, or other information were accessed or compromised. We believe the information accessed was limited to general user information, which includes usernames, emails, and encrypted passwords."
"We take our responsibility to protect our users' data extremely seriously and constantly improve our security infrastructure and policies. Following this incident, we have implemented numerous additional safeguards. Not only have we taken steps to address the specific issues that led to this incident, but we are also conducting a comprehensive security review and are implementing more general measures to proactively enhance security. We are also alerting relevant authorities to the matter and will co-operate with their investigation."
And they posted about a security incident on their blog on Oct 1. https://support.scribd.com/hc/en-us/articles/53787421531284-...
>Why not tell all customers at once, especially if payment information was involved?
Answered in the article!
“Q: Am I affected? How will I be notified?
A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet“
And also..
"Q: Where can I find the latest updates?
A: The latest updates regarding the incident will be made available on this page.“
..."Updated October 01, 2026 19:29"
For a site where you find data, they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared.
> A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet
That doesn't answer why they are doing it in phases.
Correct!
“they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared“
Call them up!
This particular set of beached data could stop existing if, instead of reusing a set of fixed data for payments, your bank allowed you to generate a unique code that sent a one-time (or recurring, locked to a single vendor) payment to the recipient.
Also known as virtual cards, discussed here [0]. At the moment, the onus is up to the cardholder and availability of the service from banks. It should be requested if your bank doesn't provide it.
0 https://news.ycombinator.com/item?id=50313747
The victims, absolutely. However; the organization not one damn iota. Perhaps if they sucked less, but they do not, so I do not.
Because nobody uses this cancer scam website lol.
They were always just that thing that showed up in Google searches cause they scraped presentations and stuff that was unknowingly public. But I didn’t quite know why anyone found them of value.
And also, that this is over.
Uploaders don't even get paid at all for views, it's just taking free labor and paywalling access to it, very similar to the infamous paid academic journals. But journals survive because they are an entrenched system that lives on prestige and hard-to-change academic bureaucracy. I really don't understand how Scribd, being an obvious scam and without those legacy advantages, can survive. I suppose hosting PDFs costs so little that a 0.001% of victims paying is enough to support it, but still, I don't understand why a free competitor hasn't come up to outrank it in searches and send it to oblivion where it belongs.
In retrospect, this was the correct way to proceed.
The docs I found were content, but nothing that could be used for its original purpose. Splurging a monthly subscription to find out sucked, but being breached and getting my info stolen is a kick in the ass.
You can just get a replacement credit card.
Our saying so is in no way a pledge that we are good at security or diligent about anything but billing you."
I'm not saying everything can be secured easily, but a lot of those leaks recently could have been prevented easily.
As long as people are still using glass sliders and Schlage locks to protect their actual stuff, sec will continue to be looked at as black magic, like SEO, GEO, and unironically, CEO.
They stated that they're doing a staggered rollout for email notifications which states at the beginning of October with other users reporting receiving the email yesterday[0].
0 https://news.ycombinator.com/item?id=50313006
"If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time."
Surely this is common? Surely?
Interestingly, that's not true. Homomorphic encryption can let you perform the same operations on encrypted data as on the plaintext, with the same results once decrypted. But it's vastly slower and less efficient - I know there are libraries like Microsoft SEAL but I've never seen anything that uses it in practice.
I think the color actually got lightened a few times.
It's nothing so sophisticated - I've just been reluctant to change things for a bunch of reasons, some perhaps better than others.
I still have the idea of letting users upload their own preferred CSS to make HN look how they prefer. Perhaps little projects like this will become more feasible as AI tools are flattening the development curve. Is this something people would consider helpful?
CSS upload is interesting, with benefits over userscripts. Perhaps it’d avoid feature creep compared to adding the specific option to increase text post contrast (if there are other oft-requested changes). Folks would find ways to share their CSS whether or not the settings page aided in discoverability via gallery or a search link or whatnot.
Curious if new or logged out users browsing the default site face an accessibility issue with the text contrast: that would still support making the change for all with no opt-in required. (Then your custom CSS idea could be used to get back to the legacy gray text if anyone misses it.)
Edit: “@dang” apparently doesn’t ‘work’, but emailed this to hn@ycombinator.com
>we found that the third party may have accessed your email address... last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history
> but there are hardly any adequate alternatives for the rest of the world, as far as I know.
Maybe start with your bank?
My local (Central European) bank offered virtual cards service yesterday to which I declined setting them up on site, will strongly reconsider now, thanks!
Maybe a good time to call up the bank (or other banks) and ask them if they provide this or any other service that would prevent you from needing to cancel physical cards in case of these ever-increasing security incidents?
Late edit: just checked it out and the virtual cards can be ordered via the banking app, either permanent virtual or one-time use where the card auto-expires after the purchase has gone through. That's really neat! (Not gloating but sharing what I've learned, hope you can find similar security in your bank offerings).
I doubt I'll have any influence on the products any one bank in my country offers, but it doesn't hurt to ask.
Use it for money laundering and fraud.