Substack Data Breach Exposes Millions of User Emails and Phone Numbers – What It Means for You

In early February 2026, Substack disclosed that a security incident dating back to October 2025 had allowed an unauthorized party to access limited user data. The breach revealed email addresses, phone numbers, and internal metadata for an undisclosed number of accounts. While passwords, credit‑card details, and other financial information remain protected, the exposure of contact information raises serious data privacy concerns for writers, readers, and businesses that rely on the platform.

Substack’s CEO Chris Best confirmed the breach in an email to affected users, apologizing for the lapse and outlining steps the company is taking to remediate the issue.

• Email addresses: Direct contact information that can be used for phishing, spam, or credential‑stuffing attacks.
• Phone numbers: Personal identifiers that enable SIM‑swap attacks or unsolicited calls.
• Internal metadata: Includes timestamps, subscription status, and other non‑financial details that help map user activity.

The breach did not compromise passwords, payment details, or two‑factor authentication tokens, according to Substack’s internal investigation. However, the exposed data is sufficient for malicious actors to craft highly targeted social‑engineering campaigns.

“I’m incredibly sorry this happened. We take our responsibility to protect your data and your privacy seriously, and we came up short here.” – Chris Best, CEO of Substack

Cybersecurity analyst Maya Patel of CISA noted that “email and phone number leaks are often the first step in a broader credential‑theft chain. Users should treat any unexpected communication with heightened suspicion.”

Data‑privacy lawyer Luis Ortega added, “Even though passwords were not compromised, the breach violates the principle of data minimization. Companies must treat personal identifiers with the same rigor as financial data.”

If you received a notification from Substack, assume that your email address and phone number are now publicly known. Follow these immediate steps:

1. Enable two‑factor authentication (2FA) on all accounts that use the same email address.
2. Update passwords on any service where you reused the compromised email as a username.
3. Monitor for phishing attempts—especially emails that reference Substack newsletters or ask for login credentials.
4. Consider a phone number change if you receive suspicious calls or SMS messages.
5. Use a password manager to generate unique, strong passwords for each service.

For businesses that rely on Substack for marketing or community building, it’s prudent to audit your contact lists and inform subscribers about the breach, offering guidance on how to stay safe.

For a comprehensive account of the breach, see the original Verge article. The piece includes additional context about Substack’s response timeline and expert commentary.

The Substack data breach underscores the growing risk of email and phone number exposure in the era of digital publishing. While Substack has taken steps to remediate the vulnerability, the incident serves as a reminder that even platforms without direct financial data can become attractive targets for attackers.

By adopting robust security practices—such as multi‑factor authentication, vigilant phishing awareness, and leveraging AI‑driven privacy tools like those offered by About UBOS—individuals and organizations can reduce their attack surface and respond more effectively to future incidents.

Stay informed, stay protected, and consider integrating advanced AI security solutions to keep your data safe in an increasingly hostile digital landscape.