# Scribd breach exposes user data across Scribd, Slideshare, Everand and Fable · pwn.watch > Scribd, Inc., which runs Scribd, Slideshare, Everand and Fable, says an unauthorized third party got into its systems, moved on to other internal systems and accessed user information. For most accounts that was basic account information; for a smaller number it was more sensitive. Notices sent by Epiq on Scribd's behalf vary by user: reported examples list email addresses, payment history, the last 4 card digits with issuer and expiry date, and titles read or searched. Full card numbers are not listed in the notices. Scribd says it closed the vulnerability, notified law enforcement and data protection authorities, and is notifying affected users in phases. It has not said how many accounts were affected. Page: https://pwn.watch/i/scribd-slideshare-everand-user-data-breach-oct-2026 · generated 2026-10-31T05:10:17.216Z ## Status - Severity: medium · status: live · patch: partial - Product: Scribd, Slideshare, Everand and Fable user accounts - Started: 2026-10-01 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/scribd-slideshare-everand-user-data-breach-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/scribd-slideshare-everand-user-data-breach-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/scribd-slideshare-everand-user-data-breach-oct-2026.json - This file: https://pwn.watch/i/scribd-slideshare-everand-user-data-breach-oct-2026/llms.txt ## Updates (newest first) - 2026-10-30: Romanian users report notices listing email address, payment history without card details, and titles read or searched as possibly accessed. (https://business24.ro/incident-de-securitate/scribd-notificare-utilizator-romania-incident-securitate-conturi-1673136) - 2026-10-26: Users report notification emails sent by Epiq on behalf of Scribd, Inc.; one notice posted to Hacker News lists the email address, last 4 card digits, card issuer, expiry date, country and payment history as possibly accessed. (https://news.ycombinator.com/item?id=50312756) - 2026-10-01: Scribd's help center notice (last updated Oct 1) says an unauthorized third party gained access to its systems, moved on to other internal systems and accessed user information: basic account information for most accounts, more sensitive information for a smaller number. Scribd says it closed the vulnerability, brought in outside forensic experts, notified law enforcement and data protection authorities, and asks users to reset their Scribd, Slideshare, Everand and Fable passwords. (https://support.scribd.com/hc/en-us/articles/53787421531284-Information-about-the-recent-security-incident) ## Fix brief # Security brief: Scribd breach exposes user data across Scribd, Slideshare, Everand and Fable Source: https://pwn.watch/i/scribd-slideshare-everand-user-data-breach-oct-2026 · status: live · severity: medium · updated Oct 31, 2026, 03:00 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Scribd, Inc., which runs Scribd, Slideshare, Everand and Fable, says an unauthorized third party got into its systems, moved on to other internal systems and accessed user information. For most accounts that was basic account information; for a smaller number it was more sensitive. Notices sent by Epiq on Scribd's behalf vary by user: reported examples list email addresses, payment history, the last 4 card digits with issuer and expiry date, and titles read or searched. Full card numbers are not listed in the notices. Scribd says it closed the vulnerability, notified law enforcement and data protection authorities, and is notifying affected users in phases. It has not said how many accounts were affected. Severity detail: Confirmed breach of user data at a large consumer platform, including partial card details and reading history for some users; no full card numbers or passwords listed, and the number affected is not disclosed - Product: Scribd, Slideshare, Everand and Fable user accounts ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you have a Scribd, Slideshare, Everand or Fable account, reset its password (and anywhere you reused it), turn on MFA where offered, and treat billing or account emails claiming to be from these services as possible phishing: go to the site directly instead of clicking links. Check card statements if you paid for a subscription. ## Latest updates - Oct 30, 2026: Romanian users report notices listing email address, payment history without card details, and titles read or searched as possibly accessed. - Oct 26, 2026: Users report notification emails sent by Epiq on behalf of Scribd, Inc.; one notice posted to Hacker News lists the email address, last 4 card digits, card issuer, expiry date, country and payment history as possibly accessed. - Oct 1, 2026: Scribd's help center notice (last updated Oct 1) says an unauthorized third party gained access to its systems, moved on to other internal systems and accessed user information: basic account information for most accounts, more sensitive information for a smaller number. Scribd says it closed the vulnerability, brought in outside forensic experts, notified law enforcement and data protection authorities, and asks users to reset their Scribd, Slideshare, Everand and Fable passwords. ## Advisories - [Information about the recent security incident](https://support.scribd.com/hc/en-us/articles/53787421531284-Information-about-the-recent-security-incident) (Scribd Help Center) ## Write-ups & news - [Scribd notifică utilizatorii din România privind un incident de securitate cu impact asupra conturilor](https://business24.ro/incident-de-securitate/scribd-notificare-utilizator-romania-incident-securitate-conturi-1673136) - [Suosittu verkkopalvelu joutui tietomurron kohteeksi, käyttäjien tiedot vaarassa](https://www.verkkouutiset.fi/a/suosittu-verkkopalvelu-joutui-tietomurron-kohteeksi-kayttajien-tiedot-vaarassa/) - [Tell HN: Scribd Breached](https://news.ycombinator.com/item?id=50312756) ## Caveats Scribd's notice does not give dates for the intrusion or how many users were affected. Notices are going out in phases, so not having one yet doesn't mean an account was unaffected. --- Machine-readable: https://pwn.watch/i/scribd-slideshare-everand-user-data-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.