NetGalley netgalley.com NetGalley data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In December 2020, NetGalley was hacked and a backup of its member database was accessed. About 1.4 million email addresses were exposed, with names, usernames, addresses, phone numbers, birth dates and hashed passwords.
View all 13,118 breaches- Breach date
- 21 Dec 2020
- Affected
- 1,436,435
- Data exposed
- Dates of birth, Email addresses, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
NetGalley, the site where publishers share advance copies of books with reviewers, librarians and booksellers, was hacked on December 21, 2020. The attackers first defaced the website. Further investigation showed they had also reached a backup of the database that holds member data.
NetGalley emailed members on December 23, 2020. It said it could not rule out that some of the information members had shared with the site was exposed, and it made everyone reset their password at the next login.
What was exposed
Have I Been Pwned lists 1.4 million unique email addresses in the breach. Alongside them: names, usernames, physical addresses, IP addresses, phone numbers, dates of birth and passwords stored as salted SHA-1 hashes. NetGalley said it holds no financial information, so card details were not part of it.
What that means for you
A hash is a scrambled version of a password, but SHA-1 is a fast, old method, and short or common passwords can often be cracked. If you reused your NetGalley password anywhere, treat that password as known.
The bigger risk is the profile data. A name, email, phone number and home address together make a convincing phishing email or text. Expect messages that mention books, reviews or publishers, since that's what the list says about you.
Sources checked: haveibeenpwned.com, bleepingcomputer.com
Last verified against the official page:
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new, unique password on NetGalley first. Then change it on any other account that shares the old one, starting with your email. A password manager makes unique passwords painless.
- 2
Turn on two-factor authentication
Use an authenticator app on your email, bank and shopping accounts. A leaked password alone then won't get anyone in.
- 3
Expect targeted phishing and texts
Be wary of emails or texts about book review copies, account problems or prizes. Go to the site yourself instead of clicking a link.
- 4
Check whether your email is in this and other breaches
Run a free scan at serus.ai. Serus monitors breach databases and the dark web and alerts you when your email or phone number shows up. It can't remove data from a breach, but it tells you which accounts to secure first.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the NetGalley breach?
If you had a NetGalley account in December 2020, assume yes. Have I Been Pwned lets you search your email address to see if it's in the 1.4 million records.
What was exposed in the NetGalley breach?
Email addresses, names, usernames, physical and IP addresses, phone numbers, dates of birth and salted SHA-1 password hashes.
Should I change my password?
Yes, on NetGalley and on any account that used the same password. NetGalley already forced a reset, but reused passwords elsewhere are still at risk.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
