Substack Data Breach Exposes User Emails, Phones

Substack, the popular online platform for newsletters and subscriptions, has notified users of a security breach that exposed email addresses, phone numbers, and internal metadata from some accounts. The incident occurred in October 2025 but was only detected by the company on February 3, 2026, according to notifications sent to affected individuals.

In emails signed by Substack CEO Chris Best, the company explained that an unauthorized third party exploited a weakness in its systems to access the limited user data without permission. The exposed information did not include passwords, credit card numbers, or other financial details, officials confirmed. "I'm reaching out to let you know about a security incident that resulted in the email address and phone number from your Substack account being shared without your permission," Best wrote. He added, "I'm incredibly sorry this happened. We take our responsibility to protect your data and your privacy seriously, and we came short here."

Substack has not disclosed the exact number of affected users, but the notifications appear targeted at a subset, primarily those with registered accounts, such as creators and subscribers who...