Tell HN: Scribd Breached
Scribd has disclosed a security incident in which an unauthorized party may have accessed user email addresses and partial payment details, including the last four digits of credit cards, issuer, country, and expiry dates. Commenters question the company’s staggered and opaque notification process, point to its history of similar issues, and express little sympathy for a service widely seen as paywalling otherwise free PDFs. The breach is also framed as part of a broader wave of cyberattacks and rising “breach fatigue,” with debate over how AI, red-teaming, and better payment tools like virtual cards might change the security landscape.
Breach details & notifications
- Users report receiving breach emails on different days in late October.
- Scribd’s support article (linked in thread) says notices are being sent in phases; commenters note this explains the fact of delay but not the reason for it.
- Email content is described as largely a rehash of the support article, which some criticize as vague and redirecting users to phone calls.
- One quoted fragment says exposed data may include: email address, last 4 digits of credit card, country, issuer, and expiry date.
- Some wonder how to identify which card is affected; the notice directs users to a dedicated call center.
Critique of incident handling & history
- Multiple commenters question why notifications weren’t sent to all affected users at once, especially when payment info is involved.
- The incident page is criticized for providing little concrete information and being updated once in early October.
- Prior Scribd breach in 2013 is referenced; back then they claimed no payment data was accessed and pledged improved security. Commenters note history appears to be repeating.
Reputation of Scribd as a service
- Many express hostility toward Scribd, calling it predatory or “negative value” for:
- Paywalling PDFs that are or were freely available.
- Encouraging uploads without compensating uploaders.
- Making it hard to download originals and pushing subscriptions.
- Several say they routinely ignore Scribd results in search and feel no sympathy for the company, though they do for affected users.
Broader security & breach fatigue
- Some see the breach as part of a wave of incidents; others say people stopped caring about data leaks years ago, shifting to resignation.
- Discussion broadens to AI’s dual role:
- As a tool for attackers and defenders.
- As a cause of messier, less-understood codebases when used to generate code.
- There is debate over whether AI-secured code is actually safer, with some arguing human-authored code plus AI review is currently more secure.
Technical security subthreads & responses
- Clarification that “encrypted at rest” mainly protects against physical disk theft, not compromised applications.
- Homomorphic encryption is mentioned as theoretically avoiding plaintext exposure but deemed impractical today.
- Virtual/one-time credit cards are discussed as a mitigation; availability is bank-dependent.
- Some plan to reduce their “account surface area” by closing old accounts to limit future exposure.