Substack Data Breach Exposes 663K Email Addresses and Phone Numbers
What Happened
In October 2025, the Substack publishing platform suffered a data breach that was publicly disclosed in February 2026. Attackers accessed over 663,000 account records, releasing email addresses, publicly visible profile information (publication names, bios) and, for a subset, phone numbers.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance over SaaS vendor data handling, ensuring that data‑at‑rest encryption and access‑logging are verifiable.
- Highlights the importance of documented third‑party risk assessments that include breach‑notification clauses and evidence of regular security posture reviews.
- Reinforces that audit‑ready evidence (e.g., logs, encryption keys, incident‑response playbooks) must be maintained to satisfy regulator expectations for personal data protection.
Who Is Affected
- Newsletter authors and independent publishers using Substack
- Readers/subscribers of Substack publications
- SaaS platforms that integrate with Substack via APIs
- Organizations that store employee or customer email addresses on Substack for outreach
Recommended Actions
- Review all Substack accounts linked to your organization and verify the exposure of personal data.
- Validate that encryption, MFA, and logging controls are in place for any SaaS service handling PII.
- Request a detailed incident‑response report from Substack, including remediation steps and timeline.
- Update your third‑party risk register and ensure breach‑notification obligations are documented.
Technical Notes
- Attack vector: Undisclosed; likely unauthorized access to internal systems or credential compromise.
- CVE(s): None reported.
- Data types exposed: Email addresses, phone numbers, publication names, author bios (public profile information).
Source: https://haveibeenpwned.com/api/v3/breach/Substack