Substack breach exposes email addresses and profile details of about 663,000 accounts
Substack confirmed attackers took account data in October 2025; it surfaced in February 2026. Have I Been Pwned counts about 663,000 accounts (emails, profile details, some phone numbers). Passwords and cards were not taken. Expect phishing; don't act on unexpected messages.
Be wary of unexpected emails or texts that mention Substack, especially ones asking you to click a link or share a code. Substack says no password change is needed, but use a unique password and turn on two-step verification if you have a Substack account.
What’s happening
Substack, the newsletter publishing platform, told users in early February 2026 that someone had accessed some of its data in October 2025. The company says it found evidence of a problem on 3 February and emailed affected users on 5 February. Substack says the data included email addresses, phone numbers and internal metadata, and that passwords, credit card numbers and financial information were not accessed. Have I Been Pwned lists about 663,000 accounts, with email addresses and public profile details such as publication names and bios, and phone numbers for only some. A forum poster claimed 697,313 records; BleepingComputer reported that claim but could not confirm it, and Substack has not given its own count. Substack has not explained how the attacker got in. It says it fixed the problem and added safeguards, and that it has no evidence the information is being misused. Nothing newer than early February turned up in my search, so the final scale and any further fallout are not known. No charges or arrests have been reported.
- What
- Breach
- Affects
- Substack newsletter platform (account records)
- Fixed in
- Nothing to patch
- Since
- 2 Feb 2026
- Closed
- 6 Feb 2026
Timeline
- Update
Have I Been Pwned added the breach, counting about 663,000 account records with email addresses and public profile details, and phone numbers in some.
- Wider attacks
A forum user posted a database claiming 697,313 records and said it was scraped with a noisy method that was quickly patched. BleepingComputer reported the claim but had not confirmed it.
- UpdateNothing to patch
CEO Chris Best emailed affected users. Substack said emails, phone numbers and internal metadata were taken, but not passwords, card numbers or financial information, and that the flaw was fixed. It gave no count of affected accounts and did not say how the attacker got in.
- Made publicNothing to patch
Substack says it found evidence of a problem with its systems on 3 February. The data had been accessed back in October 2025.
Sources
- Newsletter platform Substack notifies users of data breachBleepingComputer · 5 Feb 2026
- Substack breach listingHave I Been Pwned · 6 Feb 2026