Breaches and incidentsBriefReported by a reputable outlet, citing the company
Substack: user emails and phone numbers accessed in October 2025, found four months later
CEO Chris Best said that on 3 Feb Substack found “a problem with our systems that allowed an unauthorized third party to access limited user data”.
- Disclosed
What happened
- CEO Chris Best said that on 3 Feb Substack found “a problem with our systems that allowed an unauthorized third party to access limited user data”: email addresses, phone numbers and internal metadata. Passwords and payment data were not accessed. A forum actor claimed about 697,000 records; Substack has not confirmed a count.
- Root cause: “a problem with our systems”, not further described; access occurred in October 2025.
- An unnamed actor on a cybercrime forum claimed the data.
- Notification emails sent 5 Feb 2026.
Sources
- https://securityaffairs.com/187659/uncategorized/hacker-claims-theft-of-data-from-700000-substack-users-company-confirms-breach.html
- https://techrepublic.com/article/news-substack-data-breach-user-accounts-leaked
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.