Breaches and incidents
Substack: user emails and phone numbers accessed in October 2025, found four months later
CEO Chris Best said that on 3 Feb Substack found “a problem with our systems that allowed an unauthorized third party to access limited user data”.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- CEO Chris Best said that on 3 Feb Substack found “a problem with our systems that allowed an unauthorized third party to access limited user data”: email addresses, phone numbers and internal metadata. Passwords and payment data were not accessed. A forum actor claimed about 697,000 records; Substack has not confirmed a count.
- Root cause: “a problem with our systems”, not further described; access occurred in October 2025.
- An unnamed actor on a cybercrime forum claimed the data.
- Notification emails sent 5 Feb 2026.