NewsCompaniesFlawsGuides
Get the app

Scribd breached: account details, and for some card details, of Scribd, Everand, SlideShare and Fable users

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.

Scribd says someone got into its systems, moved on to other internal systems and reached user data. For most people that's basic account details. For a smaller group it's the email address with the card's issuer, country, expiry date, last four digits and payment history, though not the full card number. Notices are going out in phases, by email from Epiq.

Scribd, the company behind Everand, SlideShare and Fable, says intruders reached its users' data. No full card numbers, but enough for a very convincing phone call.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

If anyone in the family reads or listens on Scribd or Everand, or keeps a reading list in Fable, they may have had an email this week from a company called Epiq. It's real. Scribd, the company behind all four, along with SlideShare, says someone broke into its systems and reached its users' data.

Scribd's own notice says the intruder got in, then moved on to other internal systems. For most people, what was reached is basic account information. For a smaller group, the notices say it's more: the email address together with the card's issuer, country and expiry date, its last four digits and the account's payment history. Not the full card number, and Scribd says it has seen no evidence the data has been misused.

Timeline

  1. Users post the notice they received, sent by email from Epiq, on Hacker News.[1]

  2. HARD publishes its article, at Watch.

Why half a card number matters

Nobody can shop with the last four digits of a card. But a scammer can use them to sound like the bank. "I'm calling from your card's fraud team about the card ending 4417, expiring in March." That detail is exactly what people are taught to listen for, and it's what makes them believe the rest of the call.

The payment history helps too. It tells a scammer when you pay, how much, and to whom, which is all they need to write a convincing "your subscription payment failed" email. The leaked email address tells them where to send it.

A real card number in a scam message proves nothing. It might have come from here.

How this reaches a family

  1. Half a card number leaksYour email address, your card’s bank, its expiry and its last four digits.
  2. A message that knows things“A charge on your card ending 4417. Not you? Cancel it here.” It’s right about the card, so it feels real.
  3. HARDIs this legit? and fake site protectionPaste the message into HARD and it tells you what it is. If someone taps the link anyway, the extension for Chrome and Brave knows hundreds of thousands of phishing sites and catches lookalike addresses before the page loads.See how it works
  4. A page that wants the restThe link asks for the full card number, the code on the back and the one-time code your bank sends.
Where HARD comes in.With HARD, the greyed-out steps don’t happen.

What to do

  1. Change the password.For each of Scribd, Everand, SlideShare and Fable the family uses. If the same password is used anywhere else, change it there too, starting with email.
  2. Treat card calls as suspect, whatever they know.If someone calls about the card, hang up and ring the number on the back of the card yourself. Banks don't mind.
  3. Ignore payment-failed emails with links.Go to the app or website yourself. Scribd says it won't ask for passwords or personal details by email, text or phone.
  4. Check the card statement this month.Nothing should change, but a quick look for anything you don't recognise costs a minute.

Or have someone do it for you. Knowing which services hold the family's details, and warning everyone when one of them leaks, is part of what private cybersecurity is for.

References

  1. ^ Hacker News (). “Tell HN: Scribd Breached”. The notice users received, quoted in full: email address, card's last four digits, country, issuer and expiry, and payment history; no full card details; no evidence of misuse yet.
  2. Scribd (). “Information about the recent security incident”. Scribd's notice: access shut down, the intruder reached other internal systems, basic account details for most and more sensitive data for some, notices sent in phases by Epiq, and its advice to reset passwords.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.