Substack Data Breach (2025): What Was Exposed & What To Do

Data breaches involving online publishing and subscription platforms have become a recurring feature of the modern threat landscape, where large collections of user contact details and profile information are frequently exposed and later redistributed. In this environment, even partial account records can enable phishing, account takeover attempts, and unwanted contact long after the initial incident. The Substack matter reported in late 2025 fits this pattern: a sizable set of account-holder records left the platform’s control and later circulated more widely, raising practical questions for writers, readers, and subscribers who rely on the service.

Public reporting indicates that Substack, the newsletter and publishing platform, experienced a data breach in October 2025 that exposed roughly 663,000 account-holder records. Those records included email addresses and publicly visible profile information such as publication names and bios; a subset also contained phone numbers. The material was subsequently circulated more widely in February 2026. Exact technical details of how the data left the organisation remain limited in public accounts, yet the scale and the nature of the fields involved make the incident consequential for anyone whose Substack account details may have been included.

What happened

According to available reporting, Substack suffered a data breach in October 2025. The incident was reported on 23 October 2025 and involved approximately 663,000 account-holder records. Those records contained email addresses together with publicly visible profile information drawn from Substack accounts, including publication names and bios. A subset of the records also included phone numbers. Public accounts state that the material was later circulated more widely in February 2026. No further Reported Details have been released regarding the precise method of compromise, the full duration of unauthorised access, or whether additional data categories beyond those named were involved. Attribution to any specific threat actor has not been established in the facts available for this summary.

How a breach like this happens

Incidents that result in the exposure of account-holder contact and profile data typically follow a small number of well-understood pathways. Attackers may obtain credentials through phishing or credential-stuffing campaigns that reuse passwords leaked from other services. They may exploit unpatched software vulnerabilities, misconfigured cloud storage, or weak access controls on administrative interfaces. Once inside a system, an adversary can often extract bulk records of user email addresses, associated profile fields, and any secondary contact details that the platform stores. In many cases the stolen data is later packaged and redistributed on criminal forums or leak sites months after the initial intrusion, which matches the timeline described for this matter—initial breach in October 2025 followed by wider circulation in February 2026. None of these general mechanisms has been confirmed as the cause of the Substack incident; they simply illustrate how comparable exposures commonly occur.

Who is Substack?

Substack is a publishing platform that enables writers, journalists, and organisations to create and distribute newsletters and other subscription-based content directly to readers. Users create accounts that typically include an email address for login and delivery, optional profile information such as a publication name and bio, and, in some cases, a phone number for verification or account recovery. The platform sits at the intersection of media, independent publishing, and subscription commerce; it therefore holds contact and identity-linked data for both content creators and their audiences. A breach affecting hundreds of thousands of such records is consequential because the same email addresses and profile details that facilitate legitimate newsletter delivery can also be used by third parties for unsolicited messaging, social-engineering attempts, or correlation with other leaked datasets.

What data was at risk

The facts identify the exposed data types as email addresses and, for a subset of records, phone numbers. The same records also contained publicly visible profile information from Substack accounts, specifically publication names and bios. No other categories—such as payment-card numbers, full physical addresses, passwords, or private message content—are named in the available reporting. Organisations of this type ordinarily store additional account metadata, subscription preferences, and authentication tokens, yet the precise contents of the full dataset beyond the fields listed remain unconfirmed. Readers should therefore treat only the named elements as established and regard any further assumptions as speculative.

Why it matters

For affected individuals the primary risks are practical rather than catastrophic. Email addresses can be used to craft convincing phishing messages that impersonate Substack or related services, potentially leading to further credential theft or malware delivery. Phone numbers, where present, open additional channels for smishing or voice-based social engineering. Publicly visible profile details such as publication names and bios can help an attacker personalise those approaches, increasing the chance that a recipient will engage. For the organisation, the incident creates operational and reputational costs: the need to notify users, review access controls, and maintain trust among writers and readers who depend on the platform for their livelihoods and information. Because the data was later circulated more widely, the window of potential misuse extends well beyond the original October 2025 timeframe. None of these outcomes is inevitable for every individual, yet the combination of volume and data types makes sustained vigilance warranted.

Were you affected?

If you maintain a Substack account, treat the possibility of exposure as real until you can verify otherwise. Begin by changing your Substack password and enabling any available multi-factor authentication. Review recent account activity for unfamiliar logins or subscription changes. Be especially cautious of unsolicited emails or text messages that reference your publication name, bio, or newsletter; verify any such contact through official channels rather than links supplied in the message. Monitor your email and phone for unusual activity in the coming months. As a further practical step, you can run a free exposure scan of your email address to check whether it has already appeared in known breach datasets; doing so provides an independent signal that can guide additional protective measures such as password resets on other services that share the same address.

AICompiled with AI assistance from public sources and published under our editorial standards.