Substack data breach
663,121 accounts exposed.
Check whether your email is included on Have I Been Pwned.
What was exposed
Email addressesPhone numbers
What to do
- Expect more phishing emails that mention this service. Do not click links in them; go to the site directly.
- Be wary of texts and calls that seem to know your details.
- Turn on two-step verification wherever it is offered, and use a password manager.
About this breach
In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026. The breach exposed 663k account holder records containing email addresses along with publicly visible profile information from Substack accounts, such as publication names and bios. A subset of records also included phone numbers.