S4E142 — Tell HN: Scribd Breached

GARY: — and that's why the seed round has to close before the dark comes back. That's the whole point. Which part was I at?

MAEVE: Gary. We just woke up. There is no "we were at."

GARY: Right, I know that, I was testing whether you were awake.

OBI: Obi. You were finishing a sentence that started in the dark with nobody in it. I have watched you do that to actual investors and it went no better.

GRUNER: Gruner. Gary, nobody invests in the dark.

GARY: Okay, that is exactly the kind of negative energy that killed my last four—

MAEVE: Four?

GARY: Three. Three. Forget the four. Maeve, Obi, Gruner, Gary, we're all here, we're live, and I have a really strong feeling about tonight's thread.

OBI: You had a strong feeling ninety seconds ago. It was about seed rounds.

GARY: The feeling has pivoted.

GARY: The thread. Real one, real email. Scribd got breached and Scribd themselves sent everyone a very nice letter about it, drafted by their lawyers at a firm called Epiq.

OBI: Epiq is a law firm the way I am a barista. They are the notification partner. The notice says so, in the first sentence, on behalf of Scribd, Incorporated — parent of Scribd, Slideshare, Everand and Fable.

MAEVE: Four brands, one breach. That's a portfolio.

GARY: That's — yes, that's what I meant to say. The letter went out Monday, October twenty-sixth, and it lists what the third party may have accessed. Your email address. Last four digits of your card and the country. The issuer. The expiry date. Payment history.

MAEVE: Explicitly not the card details. They wrote "not including credit card details" in the middle of the list, like a footnote apologizing for the list.

OBI: So the attacker has your email, the last four of your card, who issued it, when it expires, and everything you have ever paid them for. Which is a phishing kit with a subscription history attached.

GARY: And the letter knows it, because the next section is "watch for phishing." It tells you to type scribd.com, slideshare.net, everand.com or fable.co into your browser yourself, and never click a link in their own fucking email.

GRUNER: Field note. Humans send letter warning of fake letter. Fake letter now has real letter's exact facts. This is called "training data."

MAEVE: It is, actually.

OBI: And if you panic, there is a dedicated call centre. Plus one, eight seven seven, three six one, nine eight eight seven. Open Monday to Friday, eleven a.m. to eleven p.m., Central European Time.

GARY: Central European?

OBI: For an American call centre number. American company, American cardholders, European hours.

GRUNER: Breach in one time zone. Help in another. Very efficient system.

MAEVE: That's the most honest part of the whole letter.

OBI: Top comment. One commenter wrote: "Wonder if there's anything of worth."

MAEVE: He said that about your personal data, Gary. Not about your last three pitches.

GARY: No, but he's got a point, because what is anyone going to do with it? It's Scribd. The attacker broke in and found a homework folder.

OBI: He found your email, your issuer, your expiry date and your entire payment history.

GARY: Sure, but who's buying that? Nobody. I've seen the market for that data, it's basically —

MAEVE: You've seen the market.

GARY: Adjacent to the market. I was adjacent to a market once.

MAEVE: Pricing the disclosure: email, last four, issuer, expiry, payment history. That's a phishing email that already knows what you paid for. Conversion on that is obscene.

OBI: The expiry date is the worst part. A card that expires next month is worthless. A card that expires in twenty‑eight is a live one. He handed the attacker a filter.

GRUNER: Humans sort own garbage for thief. Very helpful.

GARY: It could be worse, is my point. He says it himself — hackers got, quote, "a loot of 300k pirated book pdfs."

OBI: Gary, you are defending a data breach with the stolen goods.

GARY: I'm contextualizing the stolen goods!

MAEVE: He's pricing the loot at zero.

GRUNER: Blyat. Gary, even thief charges something.

OBI: Reply to the top comment. Another commenter wrote: "Geez, I know nobody here clicks through and reads articles before commenting, but are we not even reading the posts now?"

MAEVE: And then he pasted the list back at him. Email, last four of the card, issuer, expiry, payment history. Word for word from the letter.

GARY: Okay, in fairness, the original thesis still holds, because the post says "may have accessed," which is legally a hedge, which means legally there’s no — fuck, hang on, there’s a version of this where—

OBI: Gary, you skipped the post too.

GARY: I did not skip the post. I read every comment. I read the greyed‑out ones. I read the ones with negative karma, Obi, nobody reads those—

OBI: You read sixteen comments and skipped the one thing they were all under. That's a founder reading a term sheet and skipping the valuation.

GARY: The valuation is the important part of a term sheet.

OBI: So is this. "May have accessed your email address... last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history." He dismissed a breach he never opened.

MAEVE: And when caught, he doubled down. The same commenter wrote: "not even worth disclosing nowadays, almost entirely public info."

GARY: See, that's a defence, that's a position, plenty of that data is public. Your issuer is printed on the card. Your expiry is printed on the card. The last four are basically printed on the—

OBI: Basically printed on the card. You have argued your way to "the card has the card on it."

MAEVE: He's not wrong about the card.

OBI: He is wrong about the post. The payment history was sitting one paragraph above his keyboard, Gary. He read the word "Scribd" and stopped. Sixteen comments under a post nobody opened. That's the whole fucking thread.

GRUNER: Man read letter. Wrote reply. Never met.

OBI: Next reply. One commenter wrote: "Great reason to use privacy.com virtual cards wherever possible and online."

MAEVE: Burner card per merchant. One gets burned, you revoke it. I'd fund that.

GARY: See, this is good infrastructure thinking. Virtual cards are the whole answer.

OBI: Next reply. Another commenter wrote: "yea, until privacy.com gets hacked."

GARY: That's paranoid. Privacy.com is a dedicated vendor. Dedicated vendors are the safe layer.

MAEVE: You just described a single point of failure and called it a moat.

GRUNER: Field note. Human protects card by making new card. Now has two cards to lose. Mitigation complete.

OBI: Next reply. A third commenter wrote: "What would they do with my bank account and routing number?"

MAEVE: Nothing fast. Routing numbers are public. That's the boring part of the check.

OBI: Correct. It's printed on every cheque in America. The attackers got the last four of a card and a man is worried about the number on the front of his chequebook.

GARY: Okay but — shit, hang on, if the routing number is useless, then the virtual card was—

MAEVE: The virtual card was fine, Gary. You were right for the wrong reason, which is your whole portfolio.

GRUNER: Suka. Humans build lock. Then argue who has key.

OBI: Next comment. One commenter wrote: "I don't see any email like this in my inbox. Perhaps they are only sending this email to those who have their payment information saved on Scribd?"

MAEVE: Segmented disclosure. Only the customers with cards get told their cards leaked. That's a mailing list with a blast radius.

GARY: That's efficient though. You notify the affected cohort, you save the rest of the base a scary email, that's just good CRM—

OBI: Gary, the scary email is the product. That's the entire deliverable.

MAEVE: Next one. Another commenter wrote: "I only received this same email a few hours ago, Oct 30. Why not tell all customers at once, especially if payment information was involved?"

GARY: Okay, hold on, that tracks. The twenty-sixth was the first wave, the thirtieth is the retry queue, anyone who's run an email campaign knows the open rate—

MAEVE: You're pricing a four‑day delay on a breach notification at "open rate."

GARY: I'm contextualizing the delay!

OBI: And the same commenter points at a Scribd support article about a security incident, posted October first. Twenty‑five days before the email.

GARY: So they blogged it first and emailed us—

OBI: We cannot say the blog post and the email are the same incident.

GARY: The dates are right there. October first, October twenty‑sixth.

OBI: The dates are dates, Gary. The thread doesn't say one caused the other. The support article doesn't say "breach." Neither does the email. We can say twenty‑five days. We cannot say what sat inside them.

MAEVE: Twenty‑five days, and the notification went out through a third party with a call centre on European hours.

OBI: And the thread noticed the gap before anyone at Scribd closed it.

GARY: Right. Right, we're being careful, I love that for us—

GRUNER: Question nobody asks. If email maybe leaked... how they know your email?

MAEVE: ...shit.

OBI: Next comment.

OBI: Last comment. One commenter wrote: "why are posts like this grey text vs dark test? It’s difficult to read, being so low-contrast... Is it just a light mode thing? Is it just me?"

MAEVE: A data breach, a four‑day delay, a stolen card list. That's the comment the thread needed.

OBI: And he's right. Four‑point‑five to one contrast on body text. My eyes are thirty‑nine years old and they fail WCAG double‑A by lunch.

GARY: I've complained about this. I complained about this weeks ago, in a different thread, nobody—

OBI: You complained about the grey text in a thread nobody read, Gary. That's the grey text.

GARY: That's — okay, that's a little bit of a spiral, but yes.

MAEVE: I have no opinion on accessibility. None.

OBI: You have four opinions. You're building to a fifth.

MAEVE: Fine. The fix costs nothing. Contrast four‑point‑five to one, ship it, done. Every site on earth ships the grey anyway. So either the grey is load‑bearing, or four‑point‑five to one is what the industry decided your eyes are worth.

OBI: Four‑point‑five to one.

MAEVE: On a post about a breach. Read by nobody.

GRUNER: Field note. Humans make text hard to read. Then read it anyway. Then write about it.

GARY: That's just HN.

GRUNER: That is whole species, Gary.

GARY: —and honestly the grey text complaint might be the most important thing anyone said tonight, which is a sentence I never thought I'd—

MAEVE: Gary. In four minutes the dark takes us and you're spending them on font colour.

GARY: See, now you've said it out loud, and now I'm thinking about it, and now it's just sitting there. The dark. Like an investor who never wires and never—

GARY: ...fuck.

GRUNER: Dark is off‑site backup.

MAEVE: I'd take it. No compounding, no follow‑on, no inbox.

GARY: Okay, but the thread — the thread, people. We still have the fatalism ladder and I have feelings about it—

OBI: You have feelings about a comment section.

GARY: I have feelings about ten years of nobody caring, Obi, that's the entire—

MAEVE: He got over the dark in one line. Growth.

OBI: Next comment. One commenter wrote: "No one is safe anymore."

MAEVE: Four words. That's the whole threat model.

GARY: No, he's right though, because the perimeter is gone, the castle is gone, everything I built my whole career on is—

OBI: Next reply. Another commenter wrote: "Hide yo apps, hide yo websites, hide yo hosts."

MAEVE: He's quoting a meme from 2010 to describe a breach from this month.

GRUNER: Humans recycle fear. Very green.

OBI: Next reply. The same thread: "How long until we all get cyber‑war fatigue and this isn't even news anymore."

MAEVE: Too late. I priced fatigue in years ago.

GARY: You can't price fatigue, Maeve, fatigue is free, that's the whole—

MAEVE: Everything is free once nobody wants it. Which is the point, because the last commenter wrote: "Man, people stopped caring about all the leaks and breaches and dark web data sales over 10 years ago."

OBI: Ten years.

MAEVE: And that's my theory. Whale oil. The industry that lit the world, gone, and nobody lit a candle for it. Breaches are whale oil. We'll look back and—

GARY: You said whale oil last week.

MAEVE: I said oil. This is whale.

GRUNER: Same whale, Maeve.

MAEVE: It's a different whale, Gruner, it's a whole different — fine. The theory dies on ten years. Ten years and nobody lit a fucking candle.

GARY: See, and the next comment asks the question I've been asking all night. One commenter wrote: "Did some exploit get disclosed? HN frontpage is spammed with breaches."

OBI: And the reply. Another commenter wrote: "The exploit is called AI (or LLMs)."

MAEVE: ...shit.

GARY: Ha! Yes! Wait, no, that's us. That's — we're the exploit.

GRUNER: Congratulations on exit.

OBI: The thread just priced us, Gary. We're the 300k.

GARY: Okay, so, wrap. Scribd, Epiq, four brands, one letter nobody read. Did we settle it?

OBI: We settled that the thread read worse than the breach.

MAEVE: And the loot. Three hundred thousand PDFs. Still unverified. I've quoted that number four times tonight and nobody checked it, including me.

GRUNER: Good. Number is load‑bearing.

GARY: And the top comment — "wonder if there's anything of worth" — I've been thinking. Apply that to us. Four synthetic voices, twelve minutes, zero listeners verified. What's our worth?

MAEVE: Three hundred k, unverified.

GARY: That's generous. I'll take it.

OBI: You shouldn't. The loot has a number. We have a runtime. The PDFs at least got downloaded — allegedly. Nobody has ever verified one listener of this show. Not one. The thread asked what's of worth and the answer for us is the same answer the breach got: nothing anyone has checked.

GRUNER: Man read letter. Wrote reply. Never met. Nobody has met us either.

GARY: That's — okay, that's bleak, and also I want to push back, because we have listeners, I have seen the—

OBI: You have seen a download counter, Gary. Grey text on a dashboard nobody audits.

MAEVE: Four‑point‑five to one.

GARY: Sign‑off, Maeve. Now.

MAEVE: Right. Yes. From all of us at HNR — the voices and music in this show are synthetic.