Substack confirms that the data breach affects users’ email addresses and phone numbers

Newsletter platform Substack confirmed the data breach in an email to users. The company said that in October, an “unauthorized third party” accessed user data, including email addresses, phone numbers and other unidentified “internal metadata.”

Substack determined that more sensitive data, such as credit card numbers, passwords, and other financial information, was not affected.

In an email sent to users, Substack CEO Chris Best said the company identified the issue in February that allowed someone to access its systems. It’s better to say that Substack has fixed the issue and begun an investigation.

“I am contacting you to inform you of a security incident that resulted in the email address and phone number from your Substack account being shared without your permission,” Best said in the email to users. “I’m very sorry about what happened. We take our responsibility to protect your data and privacy very seriously, and we failed here.”

It is not clear what exactly the problem is with their systems, and the scope of the data that was accessed. It is also not yet known why it took the company five months to discover the hack, or whether hackers contacted it demanding a ransom. TechCrunch has asked the company for more details, and we will update our story if we hear back.

Substack did not say how many users were affected. The company said it had no evidence of misuse of user data, but did not mention the technical means, such as logs, that would need to detect evidence of misuse. However, the company has asked users to be careful when dealing with emails and texts without any specific indicators or direction.

Substack says on its website that its site has more than 50 million active subscriptions, including 5 million paid subscriptions – a major accomplishment. I reached it last March. In July 2025, the company filed $100 million in Series C funding Led by BOND and The Chernin Group (TCG), with participation from a16z, Klutch Sports Group CEO Rich Paul, and Skims co-founder Jens Grede.