Tell HN: Scribd Breached
- ID
- 41623
- Status
- summarized
- Published
- 31 Oct 2026, 10:46 AM
- Fetched
- 01 Nov 2026, 4:06 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://news.ycombinator.com/item?id=50312756
- Source URL
- https://hnrss.org/best
Summary
- Score
- 3.0
- Created
- 01 Nov 2026, 4:07 AM
- Tags
- Audience
- developerssaas_startup_founders
What happened
A Hacker News thread relays a Scribd, Inc. breach notification email received Monday 26 Oct 2026, sent via Epiq on behalf of Scribd, Slideshare, Everand, and Fable. The notice says an unauthorized third party may have accessed users' email addresses, credit-card last four digits and country, card issuer, expiry date, and payment history, but not full card details. Scribd says it secured the affected system, notified law enforcement and data protection authorities, and found no evidence of misuse; the thread drew 322 points and 118 comments.
Why it matters
If you or your users have accounts on Scribd, Slideshare, Everand, or Fable, the exposed combination can make phishing more convincing because an email can cite the service plus card issuer, expiry, country, and payment history; the notice's own guidance is to type scribd.com, slideshare.net, everand.com, or fable.co directly instead of clicking links. For SaaS founders, it is a concrete example of a multi-brand breach notice routed through a third-party notifier, not a change to AI or developer tooling.
Discussion angle
What should a breach notice actually tell users when only card metadata and payment history leaked, and how would you word it for a multi-brand SaaS without pushing users toward phishing links?