Substack
Disclosed Feb 5, 20267 months ago663,121 accountsUnverified
Substack notifies users that emails and phone numbers were stolen in 2025
Substack told users that an unauthorized party exploited a system flaw in October 2025 to obtain email addresses, phone numbers and internal metadata, which it found in February 2026. A threat actor leaked a database of 697,313 records; Substack did not confirm a total.
What is known
| People affected | 663,121 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Feb 5, 2026 |
| Discovered | Feb 3, 2026 |
| Happened | Oct 23, 2025 |
| Attack | Hacking |
| Data exposed | Emails, Phone numbers, Other |
| Sector | Media · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Check your email | Have I Been Pwned |
Sources
| Source | |
|---|---|
| Have I Been Pwned: Substackhaveibeenpwned.com · Aggregator | Aggregator |
| Substack confirms data breach affects users' email addresses and phone numberstechcrunch.com · News | News |
| Newsletter platform Substack notifies users of data breachbleepingcomputer.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Feb 5 | |
| Have I Been Pwnedaccounts in the data | Feb 6 | 663,121 |
History of this record
- 2026-09-25 · source_type: aggregator to press · seed source
- 2026-09-25 · source_url: https://haveibeenpwned.com/Breach/Substack to https://www.bleepingcomputer.com/news/security/newsletter-platform-substack-notifies-users-of-data-breach/ · seed source
- 2026-09-25 · country: empty to US · seed source
- 2026-09-25 · sector: tech to media · seed source
- 2026-09-25 · attack: unknown to hacking · seed source
- 2026-09-25 · data_types: ["emails","phone"] to ["emails","phone","other"] · seed source
- 2026-09-25 · disclosed: 2026-02-06 to 2026-02-05 · seed source
- 2026-09-25 · discovered: empty to 2026-02-03 · seed source
- 2026-09-25 · summary: In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026. The breach exposed 663k account holder records containing email addresses along with publicly visible pr to Substack told users that an unauthorized party exploited a system flaw in October 2025 to obtain email addresses, phone numbers and internal metadata, which it found in February 2026. A threat actor leaked a database of 697,313 records; Sub · seed source
- 2026-09-25 · title: empty to Substack notifies users that emails and phone numbers were stolen in 2025 · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.