Substack is notifying some users that the email addresses and phone numbers linked to their accounts were exposed in a “security incident” last year. In an email to account holders, Substack CEO Chris Best said that a hacker had accessed internal data without authorization in October 2025, but that passwords, credit card numbers, and other financial information remain secure.
“On February 3rd, we identified evidence of a problem with our systems that allowed an unauthorized third party to access limited user data without permission, including email addresses, phone numbers, and other internal metadata,” Best said in the email. “We do not ha …