Substack confirms data breach affects users’ email addresses and phone numbers

Substack disclosed a security incident in which an unauthorized party accessed user email addresses, phone numbers, and internal metadata in October, while passwords and payment data were unaffected. The issue was identified in February, has been fixed, and is under investigation; the company has not said how many users were affected, reports no evidence of misuse so far, and advises users to be cautious with unsolicited emails and texts.