NetGalley Data Breach (2020): What Was Exposed & What To Do

Breaking down the breach

The breach occurred at NetGalley, a platform that connects publishers and authors with readers for book promotion. Public reporting on the incident states that 1.4 million unique email addresses were exposed along with the additional categories of personal information listed above. No further details on the timing of the intrusion, the method of access or the total volume of records accessed have been disclosed in available information.

How a breach like this happens

Incidents involving the exposure of user account data often begin with unauthorised access to a company’s systems through compromised credentials, unpatched software or misconfigured databases. Once inside, an attacker may locate and copy tables that store registration or profile information. The presence of hashed passwords indicates that the organisation stored credentials in a non-plaintext format, though the strength of that protection depends on factors such as hash iteration and salt uniqueness that remain unconfirmed in this case.

NetGalley and its sector

NetGalley operates in the publishing services sector, providing an online service that allows users to request advance copies of books and to interact with publishers. Organisations of this type routinely collect account details, contact information and demographic data to manage user profiles and fulfil service requests. A breach at such a platform can affect a wide range of individuals who registered to receive promotional materials or to review titles.

What was likely exposed

The reported data types include the following items:

• Dates of birth
• Email addresses
• IP addresses
• Names
• Passwords (salted SHA-1 hashes)
• Phone numbers
• Physical addresses
• Usernames

Exact confirmation of which records were accessed for every affected account has not been published.

Why it matters

Exposure of names, addresses, phone numbers and dates of birth can increase the risk of targeted phishing or identity-related misuse for the individuals concerned. Hashed passwords limit immediate reuse on other sites provided the hashes are not cracked, yet any account that reused the same password elsewhere remains potentially vulnerable. For the organisation, the incident highlights the consequences of holding large volumes of user data even when basic protective measures such as hashing are in place.

If your data was in this breach

Individuals can begin by changing the password on their NetGalley account and on any other service where the same password was used. Enabling multi-factor authentication where available adds a further layer of protection. Monitoring email accounts for unusual login attempts and reviewing statements from financial or government services can help detect misuse. Readers may also run a free exposure scan of their email address against known breach data sets to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.