NetGalley
Disclosed Dec 23, 20205 years ago1,436,435 accountsConfirmed
In December 2020, the book promotion site NetGalley suffered a data breach . The incident exposed 1.4 million unique email addresses alongside names, usernames, physical and IP addresses, phone numbers, dates of birth and passwords stored as salted SHA-1 hashes.
What is known
| People affected | 1,436,435 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Dec 23, 2020 |
| Happened | Dec 21, 2020 |
| Attack | Not stated |
| Data exposed | Dates of birth, Emails, IP addresses, Names, Passwords, Phone numbers, Addresses |
| Sector | Tech · US |
| Status | Confirmed |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: NetGalleyoag.ca.gov · Official notice | Official notice |
| Have I Been Pwned: NetGalleyhaveibeenpwned.com · Aggregator | Aggregator |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | Dec 23, 2020 | |
| Have I Been Pwnedaccounts in the data | Feb 23, 2021 | 1,436,435 |
History of this record
- 2026-09-25 · hibp: empty to NetGalley · backfill source
- 2026-09-25 · sector: other to tech · backfill source
- 2026-09-25 · data_types: [] to ["dob","emails","ip-addresses","names","passwords","phone","addresses"] · backfill source
- 2026-09-25 · records_basis: empty to hibp · backfill source
- 2026-09-25 · records: empty to 1436435 · backfill source
- 2026-09-25 · summary: empty to In December 2020, the book promotion site NetGalley suffered a data breach . The incident exposed 1.4 million unique email addresses alongside names, usernames, physical and IP addresses, phone numbers, dates of birth and passwords stored a · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.