Scribd breach exposes user data across Scribd, Slideshare, Everand and Fable
Scribd, Slideshare, Everand and Fable user accounts
Scribd, Inc., which runs Scribd, Slideshare, Everand and Fable, says an unauthorized third party got into its systems, moved on to other internal systems and accessed user information. For most accounts that was basic account information; for a smaller number it was more sensitive. Notices sent by Epiq on Scribd's behalf vary by user: reported examples list email addresses, payment history, the last 4 card digits with issuer and expiry date, and titles read or searched. Full card numbers are not listed in the notices. Scribd says it closed the vulnerability, notified law enforcement and data protection authorities, and is notifying affected users in phases. It has not said how many accounts were affected.
Why this severity: Confirmed breach of user data at a large consumer platform, including partial card details and reading history for some users; no full card numbers or passwords listed, and the number affected is not disclosed
- Started
- Oct 1, 2026
Affected
Not published yet
Fixed in
No fixed release yet
Timeline3
Romanian users report notices listing email address, payment history without card details, and titles read or searched as possibly accessed.
Users report notification emails sent by Epiq on behalf of Scribd, Inc.; one notice posted to Hacker News lists the email address, last 4 card digits, card issuer, expiry date, country and payment history as possibly accessed.
Scribd's help center notice (last updated Oct 1) says an unauthorized third party gained access to its systems, moved on to other internal systems and accessed user information: basic account information for most accounts, more sensitive information for a smaller number. Scribd says it closed the vulnerability, brought in outside forensic experts, notified law enforcement and data protection authorities, and asks users to reset their Scribd, Slideshare, Everand and Fable passwords.
Advisories1
News & write-ups3
Notes & caveats
Scribd's notice does not give dates for the intrusion or how many users were affected. Notices are going out in phases, so not having one yet doesn't mean an account was unaffected.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
