Scribd Confirms Data Breach Exposing User Payment Details

Security Incident at Scribd Inc.

Scribd Inc. has officially disclosed a significant security breach affecting its user base. The company, which operates a diverse portfolio of digital content platforms including Scribd, Slideshare, Everand, and Fable, confirmed that an unauthorized third party gained access to specific systems containing user data. The notification regarding this incident was distributed on Monday, October 26, 2026, marking the first public acknowledgment of the breach.

Scope of Compromised Data

According to the notice, the unauthorized access may have exposed a range of personal and financial information. Affected users may have had their email addresses accessed, alongside specific credit card details. The exposed data includes the last four digits of credit card numbers, the country associated with the card, the card issuer, the expiry date, and payment history. Notably, the full credit card numbers were not included in the compromised dataset. The breach underscores the persistent vulnerability of digital platforms that handle sensitive payment information, even when full card details are ostensibly protected.

Role of Epiq and Notification Process

The disclosure was issued on behalf of Scribd Inc. by Epiq, a well-known notification partner and crisis management firm. Epiq’s involvement suggests a structured approach to managing the fallout and communicating with affected parties. The timing of the notification, arriving in late October 2026, indicates that the incident was detected and investigated prior to the public announcement. Companies often engage such firms to ensure regulatory compliance and to manage the logistical challenge of contacting potentially thousands of users securely and efficiently.

No Evidence of Misuse

A critical aspect of Scribd’s statement is the assertion that there is currently no evidence that the accessed data has been misused. This distinction is vital for users assessing their risk. While the data is sensitive, the lack of confirmed misuse suggests that the attackers may not have yet monetized the information or that detection systems prevented further exploitation. However, the company emphasizes that the notification is sent out of an abundance of caution. This proactive stance is common in the industry, allowing users to take preventive measures before any potential fraud occurs.

Warning Against Phishing

Scribd and Epiq have issued strong warnings regarding phishing attempts. Cybercriminals often exploit security breaches to launch targeted phishing campaigns, pretending to be the affected company. Users are advised to remain vigilant and avoid clicking on links in suspicious emails or texts. The notice explicitly states that Scribd will never ask for usernames, passwords, or other sensitive information via email or text. If users receive such communications, they are instructed to type the official website addresses directly into their browsers rather than following provided links.

User Guidance and Next Steps

For users concerned about the breach, Scribd provides specific guidance. Affected individuals are encouraged to monitor their financial statements for any irregularities. The company has established a dedicated phone line, +1-877-361-9887, for users to call during business hours, Monday through Friday. This direct line serves as a resource for those who need further clarification or assistance regarding the incident. The emphasis on direct contact through official channels aims to prevent users from falling victim to secondary attacks.

Key takeaways

• Scribd Inc. disclosed a security breach affecting user data on October 26, 2026.
• Compromised data includes emails, partial credit card info, and payment history.
• Epiq, a notification partner, issued the alert on behalf of Scribd.
• There is no evidence of data misuse at this time.
• Users are warned against phishing scams exploiting the breach.
• Affected users can contact Scribd directly via phone or official websites.