Substack Alerts Users to Data Breach Exposing Emails and Phone Numbers from Late 2025 Hack

Mlq.Ai • February 5, 2026

Substack began notifying users on February 5, 2026, of a data breach from October 2025 that exposed email addresses, phone numbers, and internal metadata to an unauthorized party. The company stated that more sensitive information such as passwords and financial details remained secure, and the exploited vulnerability has been fixed[1][2][4].

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Substack Breach Exposes User Emails and Phone Numbers from October Hack Substack has disclosed a security breach that exposed user email addresses and phone numbers due to a hack that occurred in October 2025. The breach went undetected for four months, with CEO Chris Best confirming that no passwords, credit card information, or financial data were compromised. Users were notified on February 3, 2026, but details about the number of affected users and the technical specifics of the vulnerability remain undisclosed. 30 sources 43

Substack Alerts Users to Data Breach Exposing Emails and Phone Numbers from Late 2025 Hack

The full story

Extracted Entities

Attack Types (1)

Companies (1)