Substack Breach Exposes User Emails and Phone Numbers from October Hack

Substack has disclosed a security breach that exposed user email addresses and phone numbers due to a hack that occurred in October 2025. The breach went undetected for four months, with CEO Chris Best confirming that no passwords, credit card information, or financial data were compromised. Users were notified on February 3, 2026, but details about the number of affected users and the technical specifics of the vulnerability remain undisclosed.