Breachesby GlyphSubstack
Disclosed Feb 5, 2026663,121 accountsUnverified
Substack notifies users that emails and phone numbers were stolen in 2025
Substack told users that an unauthorized party exploited a system flaw in October 2025 to obtain email addresses, phone numbers and internal metadata, which it found in February 2026. A threat actor leaked a database of 697,313 records; Substack did not confirm a total.
What is known
| People affected | 663,121 (accounts in the leaked data, per Have I Been Pwned) |
|---|---|
| Disclosed | Feb 5, 2026 |
| Discovered | Feb 3, 2026 |
| Happened | Oct 23, 2025 |
| Attack | Hacking |
| Data exposed | EmailsPhone numbersOther |
| Sector | Media · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
| Check your email | Have I Been Pwned |
Sources
Notices filed
History of this record
aggregator to pressby seedSource
https://haveibeenpwned.com/Breach/Substack to https://www.bleepingcomputer.com/news/security/newsletter-platform-substack-notifies-users-of-data-breach/by seedSource
empty to USby seedSource
tech to mediaby seedSource
unknown to hackingby seedSource
["emails","phone"] to ["emails","phone","other"]by seedSource
2026-02-06 to 2026-02-05by seedSource
empty to 2026-02-03by seedSource
In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026. The breach exposed 663k account holder records containing email addresses along with publicly visible pr to Substack told users that an unauthorized party exploited a system flaw in October 2025 to obtain email addresses, phone numbers and internal metadata, which it found in February 2026. A threat actor leaked a database of 697,313 records; Subby seedSource
empty to Substack notifies users that emails and phone numbers were stolen in 2025by seedSource
First recordedby backfillSource
First seen 2026-09-25 (Have I Been Pwned). Record counts are as reported. Not legal advice.