Substack data breach confirmed: user phone numbers email addresses all stolen in attack, here’s what we know

• Substack confirms October 2025 breach that exposed user emails, phone numbers and metadata
• CEO Chris Best assured that no financial data or credentials were accessed; hole patched and investigation underway
• BreachForums thread touts ~700,000 stolen records, despite Substack claiming no evidence of abuse to date

Substack has confirmed that threat actors broke into its systems and stole user emails and phone numbers.

On social media, people are sharing screenshots of a data breach notification letter sent to affected individuals by Substack CEO Chris Best, saying the company found “evidence of a problem with our systems” on February 3. This issue allowed an unidentified and unauthorized third party to “access restricted user data without authorization, including email addresses, phone numbers, and other internal metadata.”