Substack Discloses Breach Exposing its User Details After Four-Month Delay

Substack disclosed that an unauthorized third party accessed subscriber email addresses, phone numbers and unspecified internal metadata in October 2025 but the company only detected evidence of the breach in February, creating a four-month dwell time. Substack reports no access to credit card numbers or passwords, says it has fixed the vulnerability and is investigating, but has not disclosed the number of affected users or full scope; exposed contact information raises heightened risk of targeted phishing and smishing campaigns.