Substack substack.com Substack data breach: what happened and what to do
An unauthorized party accessed Substack user data in October 2025, and Substack told users in early February 2026. Have I Been Pwned lists 663,121 accounts, with email addresses and phone numbers exposed. Substack said passwords and card numbers weren't accessed.
View all 13,115 breaches- Breach date
- 23 Oct 2025
- Made public
- 3 Feb 2026
- Affected
- 663,121
- Data exposed
- Email addresses, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Substack, the newsletter platform, told users in early February 2026 that an unauthorized third party had accessed some of their data. Have I Been Pwned (HIBP) gives a breach date of 23 October 2025, added the data on 6 February 2026, and counts 663,121 accounts.
What happened
Substack's notice, signed by CEO Chris Best, said an unauthorized third party accessed email addresses, phone numbers and other internal metadata. The notice said credit card numbers, passwords and financial information weren't accessed. Best wrote that the company had fixed the problem in its system that allowed the access and was running a full investigation.
A hacker had posted a file claiming nearly 700,000 user records. Substack didn't confirm a figure of its own in the coverage reviewed, so HIBP's 663,121 accounts is the number to rely on. The incident went unnoticed for roughly 100 days between October 2025 and early February 2026. Substack hasn't explained how the attackers got in.
What was exposed
HIBP lists two data types: email addresses and phone numbers. The people affected are those with a Substack account. According to coverage of the incident, readers who simply subscribe to a newsletter by email, without an account, shouldn't be affected.
What that lets criminals do
With no passwords in the data, the risk is not someone logging in as you. The risk is contact. An email and a phone number let a scammer send a message that fits your reading habits, such as a fake "your subscription payment failed" email or a text that claims to be from a writer you follow.
A phone number also opens up SIM swap attempts, where a criminal tries to convince your mobile carrier to move your number to their SIM so they can receive your verification codes. A leaked number doesn't make that attack easy by itself, but it is the first thing they need.
The company's response
Substack said it had no evidence the information was being misused and urged users to be cautious of suspicious emails and text messages. It said it fixed the issue and was investigating.
If you have a Substack account
Don't click links in unexpected messages about your subscriptions. Open Substack in your browser or app instead. If you pay writers through Substack, check your card statement for charges you don't recognize.
How to check your own exposure
Search your email address and phone number on Have I Been Pwned. If the Substack entry lists you, look at which email address your account uses, since people often have more than one. Then check your account settings in Substack for the phone number it holds, and remove it if you don't need it there. Fewer places holding your number means fewer places it can leak from. Going forward, treat any message that mentions Substack and asks you to act quickly as suspect until you've checked in the app.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls with suspicion, especially ones that quote your name, phone number or the company. Don't click links in them. Go to the company's site yourself, or call the number printed on a card or a bill.
- 2
Ask your mobile carrier about a SIM lock
Your phone number is in the data. Ask your carrier to add a PIN or lock on your account so nobody can move your number to a new SIM without it.
- 3
Use an authenticator app instead of text codes where you can
Where a site lets you choose, an authenticator app is safer than SMS codes, which a SIM swap can intercept.
- 4
Check subscription payments
Look at your card statement for charges you don't recognize. Substack said payment information wasn't accessed, but fake billing emails are an easy scam to run with this data.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus to see which breaches include your email address or phone number. Breach data can't be taken back once it's out, so the scan tells you what to change and where to stay alert.
Frequently asked
Was I affected by the Substack data breach?
Check your email on Have I Been Pwned. HIBP lists 663,121 accounts. A Serus free scan checks your email and phone number against this and other breaches.
What was exposed in the Substack breach?
Email addresses and phone numbers, according to HIBP. Substack also mentioned internal metadata and said passwords and card numbers weren't accessed.
Should I change my password?
Substack said passwords weren't accessed, so it isn't required. Changing it and turning on two-factor authentication is still a low-cost precaution.
Does it affect people who only get newsletters by email?
Coverage of the incident says it appears to affect people with Substack accounts, not readers who subscribe directly by email.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
