Substack confirms data breach affecting user contact information

Newsletter platform Substack has confirmed a “security incident” involving an “unauthorized third party” that accessed user data. According to the company, the breach occurred in October, during which the unauthorized party accessed user email addresses, phone numbers, and other unspecified internal metadata. Substack chief executive Chris Best stated that the company identified the issue in February, several months after the breach occurred. The company has since fixed the problem and started an investigation.

In an email sent to users, Best apologized for the exposure, writing, “I’m reaching out to let you know about a security incident that resulted in the email address and phone number from your Substack account being shared without your permission.” He added, “I’m incredibly sorry this happened. We take our responsibility to protect your data and your privacy seriously, and we came up short here.” Substack asserted that more sensitive data, such as credit card numbers and passwords, were not affected. The company also stated that it has no evidence that user data is being misused.

The security incident comes as the platform continues to scale its user base and financial backing. Substack’s current operational and funding metrics include:

• Active Subscriptions: More than 50 million active subscriptions on its website.
• Paid Subscriptions: 5 million paid subscriptions, a milestone the company reached last March.
• Late-Stage Venture Capital: $100 million in Series C funding—a late-stage venture capital round—raised in July 2025. The round was led by BOND and The Chernin Group, with participation from venture capital firm a16z, Klutch Sports Group CEO Rich Paul, and Skims co-founder Jens Grede.

Why it matters

The breach highlights the growing security risks for large-scale newsletter platforms that aggregate significant user contact data, even if financial information remains secure.