A Substack data breach exposed users’ emails and phone numbers

The substack is Notify some users That the email addresses and phone numbers associated with their accounts were exposed in a “security incident” last year. in Email for account holdersSubstack CEO Chris Best said a hacker accessed internal data without permission in October 2025, but passwords, credit card numbers and other financial information remain safe.

“On February 3, we identified evidence of an issue in our systems that allowed an unauthorized third party to access limited user data without authorization, including email addresses, phone numbers, and other internal identifying data,” Best said in the email. “We have no evidence of this information being misused, but we encourage you to be extra careful about any emails or text messages you receive that may be suspicious.”

Substack says it has since fixed the security issue, and is now conducting a full investigation along with strengthening its systems “to prevent this type of issue from occurring in the future.” The platform did not provide any details regarding what the security issue was, or how many users were affected – me and several others edge Colleagues who also use Substack did not receive the email. We’ve reached out to Substack for clarification.

“I am so sorry this happened,” Afzal said in an email to users. “We take our responsibility to protect your data and privacy very seriously, and we have failed here.”