I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure, just to ensure it's not too easy, but probably this isn't happening because it would be a felony to even try. The bad guys are free to try though.
All this will tend to get blamed on AI, but AI didn't put these vulnerabilities into place. AI is just a tool that can be used to discover vulnerabilities, and the only question we have to answer is whether or not that tool should be available to regular people.
Some will try to frame the question as being about whether we should allow AI aid in cyber-security, but that's not the question. This technology isn't going away. The bad guys will have it. Nations will have it. Again, the question is, can regular people also continue to have it?
As someone who has helped to secure critical national infrastructure several years ago, I can say that it was a mess to disclose the vulnerabilities I identified, and in some cases it took years to patch them. Some of these vulnerabilities were RCEs and mass PII leaks. It's simply not worth the risk for most people - who aren't in the USA - to bother doing this sort of security research. However, if you are in the USA, there are provisions in the CFAA that enable good-faith security research to take place (https://www.justice.gov/archives/opa/pr/department-justice-a...), so to the best of my understanding, you're able to do good-faith research without being charged or prosecuted, and you should take advantage of this if you have the skills or models to do so. I am not based in the USA, and there are no laws in my country that guarantee me zero jail time for simply trying to do the right thing, so I am not incentivized to continue finding vulnerabilities in my country's infrastructure.
Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.
It is absolutely happening, paid by your taxpayer dollars (if you’re American).
Most major countries have this kind of programs. Those could probably be bigger and they will always miss obvious stuff but they exist, at least for CNI.
> I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure
They are. Most critical infrastructure providers worldwide have in house or contract red teams. Every western government has an agency dedicated to cyber defense and they all have red team programs.
imagine if we just turned off 90% of the non-critical internet for two weeks, hardened up in an absolute mad dash where everyone has access to top tier cyber models, and then afterwards we go back to business as usual. it’d be a disaster short-term but long-term would it be worse than the years of slow drip we’re about to go through? idk! I kinda think it’d be interesting to find out!
It'd take more than a week, but even now, if the whole world coordinated a simultaneous quarantine, we'd eliminate covid, the flu, the common cold, and a thousand nameless respiratory cruds.
Everyone would be very difficult. You'd still need some people to make sure essential services are still functioning, and that still involves quite a large number of people.
That was my first thought as well. With COVID, we recognised that WFH was viable for white collar work. Perhaps a global 2 week cleanse will allow everyone to re-evaluate life priorities outside of the internet.
I see hope in what happened during the blackout in Spain/Portugal.
But essentially, with the power down, people came out as a community and life went on without technology. Granted, the power came back within a day, but I have confidence that they would have found a way.
Regular people are often bad guys too, you know. If the reality was "bad guys will have it. Should regular people too?" The entire core dilemma would be entirely eliminated lol.
Isn't this that website that keeps coming up in my web search results, apparently having a pdf of the thing I searched, except it's actually a badly html-ed version of said pdf with no way to download the original one?
Notable callouts from 2013: "Our investigation indicates that no content, payment and sales-related data, or other information were accessed or compromised. We believe the information accessed was limited to general user information, which includes usernames, emails, and encrypted passwords."
"We take our responsibility to protect our users' data extremely seriously and constantly improve our security infrastructure and policies. Following this incident, we have implemented numerous additional safeguards. Not only have we taken steps to address the specific issues that led to this incident, but we are also conducting a comprehensive security review and are implementing more general measures to proactively enhance security. We are also alerting relevant authorities to the matter and will co-operate with their investigation."
The email received is a rehash of the linked article, nice find.
>Why not tell all customers at once, especially if payment information was involved?
Answered in the article!
“Q: Am I affected? How will I be notified?
A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet“
And also..
"Q: Where can I find the latest updates?
A: The latest updates regarding the incident will be made available on this page.“
..."Updated October 01, 2026 19:29"
For a site where you find data, they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared.
Please forgive my stupidity, but is there any particular reason why companies never seem to disclose what "system" of theirs was breached? If this breach came about as a result of a security incident at a third-party, would it not benefit everyone minus the vendor to shift the blame? I understand that they say "our systems", but I've seen companies say this before when what they mean is "a system controlled by a vendor we contracted".
Scribd is the most predatory site that steals people's content and then doesn't honor their promise (upload a PDF to download one..oops that one doesn't qualify, but we will keep your copy!). Fuck em, they built their entire model on predatory behaviour towards broke college students, hope they burn to the ground.
> I just ignore it in my searches and just find the pdf elsewhere.
In retrospect, this was the correct way to proceed.
The docs I found were content, but nothing that could be used for its original purpose. Splurging a monthly subscription to find out sucked, but being breached and getting my info stolen is a kick in the ass.
> We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card
expiry date.
Until the people in power start going to jail or losing their jobs, instead of just paying fines as "the cost of doing business" from the company accounts, probably nothing will be fixed
They stated that they're doing a staggered rollout for email notifications which states at the beginning of October with other users reporting receiving the email yesterday[0].
>How do we even know which credit card is affected by this if we want to cancel it?
"If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time."
This is a common sentiment, but the security story isn’t so clear cut as that. Encrypted at rest really just means that if you yank the disk out of the server, an adversary can’t read it. But if it’s a system that is online serving a database and you gain access to the application reading from the database, encryption at rest doesn’t save you. It’s obvious the application server must be able to read the decrypted data. If an adversary breaches the application, they get the data.
>It’s obvious the application server must be able to read the decrypted data
Interestingly, that's not true. Homomorphic encryption can let you perform the same operations on encrypted data as on the plaintext, with the same results once decrypted. But it's vastly slower and less efficient - I know there are libraries like Microsoft SEAL but I've never seen anything that uses it in practice.
Let's say the application is storing user's phone number so it can send SMS notifications to the user. Encrypt it all you want, but when it is time to send the SMS you will need the phone number in plaintext so you can pass it to the SMS gateway.
Maybe the Cursor IDE compromise? It might be what got Binance.
And it made a lot devs machines backdoored between Wednesday 28th Oct and whenever people decide to remove the backdoor from their machines.
It's so interesting seeing all of these breaches and then going back to the old threads on Mythos and seeing the widespread skepticism and denial on HN.
@dang, always been curious about this: why are posts like this grey text vs dark test? It's difficult to read, being so low-contrast. I assume it's based on numbers, the poster, up/downvotes etc - but it seems a poor use of those systems given it sacrifices readability. Is it just a light mode thing? Is it just me?
As far as I know this is a relic from the PG days. It was done to keep the focus on URL based submissions, and avoid people using the platform as a text/blogging platform (at the time, Reddit was rising, and self posts there were already very common.) URLs were dark, text was meant to support the URL and was lighter.
I think the color actually got lightened a few times.
Was the text light grey before you clicked the comments? Typically the link turns from almost black to light grey after you visit the site, just like a normal link will turn from blue to purple after you click the link to indicate you have visited the site. In this post for example the link goes to the 'Tell HN:' so the link goes directly to the comments. Could it be you did not pay attention until you had visited the comments once already??
It's been 22 mins since I left my comment - the original post is still light grey (that doesn't mean much, but as this post accumulates upvotes, I don't yet see any change in test color).
I always assumed it was the down arrow affecting it, but I have always giggled at the fact that people with sharp eyes have to endure the bad posts while others do not
Hackers got their hands on a loot of 300k pirated book pdfs? And internal documents that were already leaked by someone that googled "how to share a pdf".
Geez, I know nobody here clicks through and reads articles before commenting, but are we not even reading the posts now?
>we found that the third party may have accessed your email address... last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history
OP> Great reason to use <...> virtual cards wherever possible and online
> but there are hardly any adequate alternatives for the rest of the world, as far as I know.
Maybe start with your bank?
My local (Central European) bank offered virtual cards service yesterday to which I declined setting them up on site, will strongly reconsider now, thanks!
>My bank is the opposite of yours. They used to offer a similar service but shuttered it a few years ago.
Maybe a good time to call up the bank (or other banks) and ask them if they provide this or any other service that would prevent you from needing to cancel physical cards in case of these ever-increasing security incidents?
Late edit: just checked it out and the virtual cards can be ordered via the banking app, either permanent virtual or one-time use where the card auto-expires after the purchase has gone through. That's really neat! (Not gloating but sharing what I've learned, hope you can find similar security in your bank offerings).
I did some research and corroborated with Claude. No banks in my country offer anything akin to Privacy.com. There are a few "virtual card" services but they have limits that make them virtually unusable.
I doubt I'll have any influence on the products any one bank in my country offers, but it doesn't hurt to ask.
I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure, just to ensure it's not too easy, but probably this isn't happening because it would be a felony to even try. The bad guys are free to try though.
All this will tend to get blamed on AI, but AI didn't put these vulnerabilities into place. AI is just a tool that can be used to discover vulnerabilities, and the only question we have to answer is whether or not that tool should be available to regular people.
Some will try to frame the question as being about whether we should allow AI aid in cyber-security, but that's not the question. This technology isn't going away. The bad guys will have it. Nations will have it. Again, the question is, can regular people also continue to have it?
As someone who has helped to secure critical national infrastructure several years ago, I can say that it was a mess to disclose the vulnerabilities I identified, and in some cases it took years to patch them. Some of these vulnerabilities were RCEs and mass PII leaks. It's simply not worth the risk for most people - who aren't in the USA - to bother doing this sort of security research. However, if you are in the USA, there are provisions in the CFAA that enable good-faith security research to take place (https://www.justice.gov/archives/opa/pr/department-justice-a...), so to the best of my understanding, you're able to do good-faith research without being charged or prosecuted, and you should take advantage of this if you have the skills or models to do so. I am not based in the USA, and there are no laws in my country that guarantee me zero jail time for simply trying to do the right thing, so I am not incentivized to continue finding vulnerabilities in my country's infrastructure.
Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.
It is absolutely happening, paid by your taxpayer dollars (if you’re American).
Most major countries have this kind of programs. Those could probably be bigger and they will always miss obvious stuff but they exist, at least for CNI.
Don't worry - Siri is on it - that's actually why they've been so lacklustre. Just too busy hacking for the good guys
> I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure
They are. Most critical infrastructure providers worldwide have in house or contract red teams. Every western government has an agency dedicated to cyber defense and they all have red team programs.
imagine if we just turned off 90% of the non-critical internet for two weeks, hardened up in an absolute mad dash where everyone has access to top tier cyber models, and then afterwards we go back to business as usual. it’d be a disaster short-term but long-term would it be worse than the years of slow drip we’re about to go through? idk! I kinda think it’d be interesting to find out!
Imagine if everyone had just stayed at home for a week in 2020.
It'd take more than a week, but even now, if the whole world coordinated a simultaneous quarantine, we'd eliminate covid, the flu, the common cold, and a thousand nameless respiratory cruds.
Everyone would be very difficult. You'd still need some people to make sure essential services are still functioning, and that still involves quite a large number of people.
That was my first thought as well. With COVID, we recognised that WFH was viable for white collar work. Perhaps a global 2 week cleanse will allow everyone to re-evaluate life priorities outside of the internet.
I see hope in what happened during the blackout in Spain/Portugal.
what happened there ?
Sorry about that, you can see this for reference: https://www.bbc.com/news/articles/c70zg3e5ej2o
But essentially, with the power down, people came out as a community and life went on without technology. Granted, the power came back within a day, but I have confidence that they would have found a way.
Don't you think it is odd that the BBC led with this feature, for what would have been a critical failure of infrastructure for a Western nation?
Losing electricity causes significant disruption, emergency generators have to turn on for hospitals, the transport system stops.
The BBC is not what it once was, so assume it is no better than any other outlet in wanting to create a narrative.
The actual reality on the ground for many people would have been far from the whimsical event the BBC portrays.
I think they are referring to the reports of people suddenly meeting on the streets and hanging out together back then.
Nothing, I guess, and that is a good thing, I guess: the world didn't even by a day (few days?) without electricity.
Regular people are often bad guys too, you know. If the reality was "bad guys will have it. Should regular people too?" The entire core dilemma would be entirely eliminated lol.
Isn't this that website that keeps coming up in my web search results, apparently having a pdf of the thing I searched, except it's actually a badly html-ed version of said pdf with no way to download the original one?
Yep, absolutely no feelings for that cancer of a website.
So if someone's got into their systems can they put a dump of all the PDFs up somewhere?
Seems Scribd made the news 13 years ago for the same issue[0] [1] and an archive.org link of the original-now-deleted announcement[2]!
0 https://news.ycombinator.com/item?id=5493280 Scribd hacked – emails and hashed passwords leaked (scribd.com) 106 points by joosters on April 4, 2013 | hide | past | favorite | 65 comments
1 https://thenextweb.com/news/scribd-reveals-it-was-hacked-thi...
2 https://web.archive.org/web/20130407114005/https://support.s...
Notable callouts from 2013: "Our investigation indicates that no content, payment and sales-related data, or other information were accessed or compromised. We believe the information accessed was limited to general user information, which includes usernames, emails, and encrypted passwords."
"We take our responsibility to protect our users' data extremely seriously and constantly improve our security infrastructure and policies. Following this incident, we have implemented numerous additional safeguards. Not only have we taken steps to address the specific issues that led to this incident, but we are also conducting a comprehensive security review and are implementing more general measures to proactively enhance security. We are also alerting relevant authorities to the matter and will co-operate with their investigation."
I only received this same email a few hours ago, Oct 30. Why not tell all customers at once, especially if payment information was involved?
And they posted about a security incident on their blog on Oct 1. https://support.scribd.com/hc/en-us/articles/53787421531284-...
The email received is a rehash of the linked article, nice find.
>Why not tell all customers at once, especially if payment information was involved?
Answered in the article!
“Q: Am I affected? How will I be notified?
A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet“
And also..
"Q: Where can I find the latest updates?
A: The latest updates regarding the incident will be made available on this page.“
..."Updated October 01, 2026 19:29"
For a site where you find data, they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared.
> Q: Am I affected? How will I be notified?
> A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet
That doesn't answer why they are doing it in phases.
>That doesn't answer why they are doing it in phases.
Correct!
“they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared“
Call them up!
Mixed feelings. I feel sorry for the people whose info was taken but Scribd does not have my sympathy.
It looks like we all enjoyed "Security through obscurity", where obscurity was referring to existing vulnerabilities.
And also, that this is over.
Please forgive my stupidity, but is there any particular reason why companies never seem to disclose what "system" of theirs was breached? If this breach came about as a result of a security incident at a third-party, would it not benefit everyone minus the vendor to shift the blame? I understand that they say "our systems", but I've seen companies say this before when what they mean is "a system controlled by a vendor we contracted".
Scribd is the most predatory site that steals people's content and then doesn't honor their promise (upload a PDF to download one..oops that one doesn't qualify, but we will keep your copy!). Fuck em, they built their entire model on predatory behaviour towards broke college students, hope they burn to the ground.
I run a few small scale SaaS products. This is a scary time.
You’re saying sribd has actually worked for people? I just ignore it in my searches and just find the pdf elsewhere.
> I just ignore it in my searches and just find the pdf elsewhere.
In retrospect, this was the correct way to proceed.
The docs I found were content, but nothing that could be used for its original purpose. Splurging a monthly subscription to find out sucked, but being breached and getting my info stolen is a kick in the ass.
https://news.ycombinator.com/item?id=50313197
> We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card expiry date.
No one is safe anymore.
No one has ever been safe. I would rephrase it as: "More and more people are becoming aware of their exposure".
Hide yo apps, hide yo websites, hide yo hosts
How long until we all get cyber-war fatigue and this isn't even news anymore.
Man, people stopped caring about all the leaks and breaches and dark web data sales over 10 years ago
Is resignation because nothing was ever fixed or done about it because it wasn't "economically viable" considered not caring?
Until the people in power start going to jail or losing their jobs, instead of just paying fines as "the cost of doing business" from the company accounts, probably nothing will be fixed
U WIN @ teh internetz comments 2 nite. congrats!
I don't see any email like this in my inbox. Perhaps they are only sending this email to those who have their payment information saved on Scribd?
> I don't see any email like this in my inbox.
They stated that they're doing a staggered rollout for email notifications which states at the beginning of October with other users reporting receiving the email yesterday[0].
0 https://news.ycombinator.com/item?id=50313006
How do we even know which credit card is affected by this if we want to cancel it?
>How do we even know which credit card is affected by this if we want to cancel it?
"If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time."
Not a security person, but are there standards for PII encrypted at rest?
Surely this is common? Surely?
This is a common sentiment, but the security story isn’t so clear cut as that. Encrypted at rest really just means that if you yank the disk out of the server, an adversary can’t read it. But if it’s a system that is online serving a database and you gain access to the application reading from the database, encryption at rest doesn’t save you. It’s obvious the application server must be able to read the decrypted data. If an adversary breaches the application, they get the data.
>It’s obvious the application server must be able to read the decrypted data
Interestingly, that's not true. Homomorphic encryption can let you perform the same operations on encrypted data as on the plaintext, with the same results once decrypted. But it's vastly slower and less efficient - I know there are libraries like Microsoft SEAL but I've never seen anything that uses it in practice.
Let's say the application is storing user's phone number so it can send SMS notifications to the user. Encrypt it all you want, but when it is time to send the SMS you will need the phone number in plaintext so you can pass it to the SMS gateway.
Did some exploit get disclosed? HN frontpage is spammed with breaches.
Maybe the Cursor IDE compromise? It might be what got Binance. And it made a lot devs machines backdoored between Wednesday 28th Oct and whenever people decide to remove the backdoor from their machines.
The exploit is called AI (or LLMs)
I'm wonder how many users are exposed
Nice, I've been trying to hack scribd to download a pdf all day
It's so interesting seeing all of these breaches and then going back to the old threads on Mythos and seeing the widespread skepticism and denial on HN.
@dang, always been curious about this: why are posts like this grey text vs dark test? It's difficult to read, being so low-contrast. I assume it's based on numbers, the poster, up/downvotes etc - but it seems a poor use of those systems given it sacrifices readability. Is it just a light mode thing? Is it just me?
As far as I know this is a relic from the PG days. It was done to keep the focus on URL based submissions, and avoid people using the platform as a text/blogging platform (at the time, Reddit was rising, and self posts there were already very common.) URLs were dark, text was meant to support the URL and was lighter.
I think the color actually got lightened a few times.
Was the text light grey before you clicked the comments? Typically the link turns from almost black to light grey after you visit the site, just like a normal link will turn from blue to purple after you click the link to indicate you have visited the site. In this post for example the link goes to the 'Tell HN:' so the link goes directly to the comments. Could it be you did not pay attention until you had visited the comments once already??
It's been 22 mins since I left my comment - the original post is still light grey (that doesn't mean much, but as this post accumulates upvotes, I don't yet see any change in test color).
It’s way, way too low contrast.
Edit: “@dang” apparently doesn’t ‘work’, but emailed this to hn@ycombinator.com
I always assumed it was the down arrow affecting it, but I have always giggled at the fact that people with sharp eyes have to endure the bad posts while others do not
I think that’s true for comments but not posts.
Wonder if there's anything of worth.
Hackers got their hands on a loot of 300k pirated book pdfs? And internal documents that were already leaked by someone that googled "how to share a pdf".
Geez, I know nobody here clicks through and reads articles before commenting, but are we not even reading the posts now?
>we found that the third party may have accessed your email address... last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history
not even worth disclosing nowadays, almost entirely public info
Great reason to use privacy.com virtual cards wherever possible and online
This is good advice for anyone who lives in the USA, but there are hardly any adequate alternatives for the rest of the world, as far as I know.
OP> Great reason to use <...> virtual cards wherever possible and online
> but there are hardly any adequate alternatives for the rest of the world, as far as I know.
Maybe start with your bank?
My local (Central European) bank offered virtual cards service yesterday to which I declined setting them up on site, will strongly reconsider now, thanks!
My bank is the opposite of yours. They used to offer a similar service but shuttered it a few years ago. A shame.
>My bank is the opposite of yours. They used to offer a similar service but shuttered it a few years ago.
Maybe a good time to call up the bank (or other banks) and ask them if they provide this or any other service that would prevent you from needing to cancel physical cards in case of these ever-increasing security incidents?
Late edit: just checked it out and the virtual cards can be ordered via the banking app, either permanent virtual or one-time use where the card auto-expires after the purchase has gone through. That's really neat! (Not gloating but sharing what I've learned, hope you can find similar security in your bank offerings).
I did some research and corroborated with Claude. No banks in my country offer anything akin to Privacy.com. There are a few "virtual card" services but they have limits that make them virtually unusable.
I doubt I'll have any influence on the products any one bank in my country offers, but it doesn't hurt to ask.
yea, until privacy.com gets hacked
What would they do with my bank account and routing number?
> What would they do with my bank account and routing number?
Use it for money laundering and fraud.
I don't even think they actually pirated book pdfs. Just previews to get you to sign up that lead to no where
Scribd has a ton of oop but copyrighted licensed content, which I highly doubt they pay licensing fees for.