The company has emailed affected users after a dark web source claims the data of almost 700,000 users was compromised.

CSO Online offers insights into cybersecurity, risk management, and IT leadership, providing articles, reports, and expert analysis to help security professionals navigate the evolving threat landscape and protect their organizations from cyber attacks. By exploring CSO Online's curated content, CISOs, security managers, and IT executives can learn about threat intelligence, security frameworks, and incident response strategies for building resilient cybersecurity programs. Whether you're defending against ransomware, phishing attacks, or insider threats, CSO Online offers resources to strengthen your security posture and safeguard your digital assets.

CSO Online

Substack discovered a data breach on February 3, 2026, that exposed email addresses, phone numbers, and internal metadata of an unknown number of users. The breach occurred in October 2025 but went undetected for four months. Dark web sources claim nearly 700,000 records were compromised, though this remains unconfirmed. The exposed data did not include passwords, credit card numbers, or financial information. Substack uses passwordless authentication via magic links sent to email addresses, which mitigates some security risks. The company has fixed the vulnerability and is conducting a full investigation.

Substack data breach leaks users’ email addresses and phone numbers