NetGalley

Disclosed Dec 23, 20201,436,435 accountsConfirmed

In December 2020, the book promotion site NetGalley suffered a data breach . The incident exposed 1.4 million unique email addresses alongside names, usernames, physical and IP addresses, phone numbers, dates of birth and passwords stored as salted SHA-1 hashes.

What is known

People affected	1,436,435 (accounts in the leaked data, per Have I Been Pwned)
Disclosed	Dec 23, 2020
Happened	Dec 21, 2020
Attack	Not stated
Data exposed	Dates of birthEmailsIP addressesNamesPasswordsPhone numbersAddresses
Sector	Tech · US
Status	Confirmed
Check your email	Have I Been Pwned

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: NetGalley

Aggregatorhaveibeenpwned.com

Have I Been Pwned: NetGalley

Notices filed

Residents of CADec 23, 2020

California AGCount not stated

Accounts in the dataFeb 23, 2021

Have I Been Pwned1,436,435 people

History of this record

hibp2026-09-25

empty to NetGalleyby backfillSource

sector2026-09-25

other to techby backfillSource

data_types2026-09-25

[] to ["dob","emails","ip-addresses","names","passwords","phone","addresses"]by backfillSource

records_basis2026-09-25

empty to hibpby backfillSource

records2026-09-25

empty to 1436435by backfillSource

summary2026-09-25

empty to In December 2020, the book promotion site NetGalley suffered a data breach . The incident exposed 1.4 million unique email addresses alongside names, usernames, physical and IP addresses, phone numbers, dates of birth and passwords stored aby backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about NetGalley