Newsletter platform Substack notifies users of data breach

Substack disclosed that an incident in October 2025 allowed an unauthorized actor to access limited user data—emails, phone numbers, and internal metadata—and a threat actor later posted roughly 697,313 records on BreachForums. The company says no passwords or payment data were exposed, the issue has been fixed, and affected users should be cautious of phishing attempts.