Substack Data Breach Reveals Users’ Email Addresses and Phone Numbers

Fast Facts

1. Substack experienced a data breach in October 2025, exposing user email addresses, phone numbers, and internal metadata, affecting an unknown subset of its roughly 35 million users.
2. The breach was identified in February 2026 after a four-month delay, with claims that approximately 697,313 records and Stripe payment IDs may have been compromised, though unconfirmed.
3. No passwords, credit card details, or financial info were exposed, and the incident mainly impacts users with Substack accounts, not newsletter subscribers using email alone.
4. Substack claims to have resolved the issue and implemented safeguards, but users are advised to remain cautious of suspicious emails, especially due to the potential scope of compromised data.

The Core Issue

Substack, a prominent publishing platform, experienced a significant data breach that compromised user information. The breach was discovered in February 2026, but it occurred in October 2025, meaning the affected data had been exposed for up to four months. The incident involved hackers exploiting a vulnerability in Substack’s systems to access email addresses, phone numbers, and internal metadata of some users. Notably, the breach did not include sensitive data such as passwords or financial information, and Substack has assured users that there’s no evidence of misuse at this time. However, this delay in detection raises concerns about the potential scope, especially since a dark web source claims nearly 700,000 records and payment IDs from Stripe may have been compromised. The company reports that the breach only affects users with Substack accounts and recommends caution, although it emphasizes that their access method relies on email-based logins, reducing the immediate risk of password theft.

The incident happened due to a security weakness that the company promptly fixed, but the cause remains unclear. Substack is conducting an investigation and has taken steps to strengthen its cybersecurity defenses. The breach’s timing and limited disclosure raise questions about transparency and future protective measures. Users are advised to remain vigilant, particularly with suspicious emails, but since password sharing is minimal—thanks to email-based authentication—urgent password changes are generally unnecessary. This event marks the platform’s first major security breach since a minor email exposure in 2020, highlighting the ongoing need for vigilance in digital security practices.

Potential Risks

A data breach like the Substack leak, which exposes users’ email addresses and phone numbers, can seriously threaten any business. First, hackers often target sensitive information to launch phishing attacks or steal identities. When customer data leaks, trust is damaged, causing customers to lose confidence and potentially leave. Additionally, legal consequences can follow if privacy laws are violated, resulting in hefty fines. Moreover, your brand’s reputation may suffer long-term harm, making future growth difficult. Ultimately, such breaches can lead to financial loss, increased security costs, and damaged relationships, proving that no business is immune to the risks of data leaks.

Fix & Mitigation

Prompted by the critical need to address data leaks swiftly, rapid remediation of breaches such as the Substack incident—where users’ email addresses and phone numbers are exposed—is vital to mitigate harm, protect user trust, and prevent further exploitation.

Containment

• Immediately isolate affected systems to prevent further data exposure.
• Disable compromised accounts and reset associated credentials.

Assessment

• Conduct a thorough investigation to determine the breach scope and entry points.
• Identify all impacted data and affected users.

Communication

• Notify users promptly about the breach with guidance on how to protect themselves.
• Coordinate with legal and regulatory bodies as required by law.

Remediation

• Patch vulnerabilities exploited during the breach to prevent recurrence.
• Review and strengthen security controls, including access management and data encryption.

Monitoring

• Implement continuous monitoring of systems for signs of ongoing or additional breaches.
• Track user reports and suspicious activity related to compromised information.

Policy Review

• Update security policies, incorporating lessons learned to enhance future defenses.
• Train staff on security best practices and breach response procedures.

Preventative Measures

• Enable multi-factor authentication for user accounts.
• Limit data collection to only necessary information to reduce risk scope.

Prioritizing swift, comprehensive action in response to leaks like the Substack data breach is essential to reduce damage, restore confidence, and reinforce organizational cybersecurity resilience.

Explore More Security Insights

Discover cutting-edge developments in Emerging Tech and industry Insights.

Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1cyberattack-v1-multisource