Substack Just Got Hacked.
If you missed the chaos from last week — I got suspended from Substack and made it back. Here’s that story. Apparently, the drama wasn’t done with me.
The Breach
Substack has been hacked since October 2025.
They only found out on February 3rd, 2026.
Four months later.
They didn’t post about it publicly. No blog post. No tweet. Just quiet emails to users who “may have been affected” — while their official blog kept posting as if nothing happened.
Nearly 700,000 accounts were compromised.
Statistically, you’re in this. So is someone you know.
(The irony of posting this first on Substack.)
What Was Leaked
The good news: no passwords, no payment card numbers.
The bad news: almost everything else.
- Full names
- Email addresses
- Phone numbers
- Connected social media accounts
- Profile pictures, usernames, bios
- Internal metadata — login timestamps, locations, preferences
- Stripe Customer IDs (can’t be used for transactions, but still)
This data is already circulating on cybercrime forums and Telegram channels, including Russian-speaking communities. A sample has been verified as legitimate. It includes records tied to journalists, professionals, and at least one US government-associated email address.
Here’s the screenshot of the actual leak:
It’s out there. The question is what someone does with it.
Why This Is Actually Dangerous
“No passwords leaked” sounds reassuring. It isn’t.
Javvad Malik, lead security awareness advocate at KnowBe4, said Substack’s notification was “a bit light on details” — noting that email addresses and phone numbers alone are “enough for targeted phishing, SIM-swap attempts, or doxxing.”
Here’s the part most people will miss:
If you’ve posted voiceovers or audio on Substack — which many creators have — your voice is now a liability.
Scammers can clone it and impersonate you to your subscribers, your colleagues, or your bank. It’s called vishing (voice phishing), and it’s disturbingly effective.
They also have your newsletter name, bio, and account history.
Any email or text that references these details will look legitimate. This is called spear phishing — targeted, personal, and far more convincing than the usual “you’ve won a prize” nonsense.
This isn’t a generic breach. This is a blueprint for impersonating you.
What You Should Do (right now)
- Check if your data was leaked
Go to haveibeenpwned.com and enter your email. Takes 10 seconds. Check if you’re specifically listed here.
- Change your Substack password
Passwords weren’t leaked, but your email and phone number are now exposed — making brute force and social engineering attempts more targeted. Use a password manager. Make it something you’ve never used before.
If your account is passwordless (Substack’s default), your email account becomes your front door. Make sure that password is strong.
- Turn on multi-factor authentication (MFA)
This is the one that actually matters. Even if someone has your email, password, and phone number — MFA stops them cold. Substack’s settings. Do it now.
- Watch for suspicious messages
Emails, texts, or DMs referencing your Substack details — newsletter name, bio, signup history — are not from Substack. They’re using your own data against you. Don’t click, don’t reply, don’t engage.
- Tell people
Substack isn’t broadcasting this.
Your readers, fellow writers, anyone who might be affected — they deserve to know. Forward this. Share it. The official email only reached a fraction of those compromised.
The Bigger Problem
Substack’s CEO Chris Best sent out this notification email. It’s fine as a gesture. It said almost nothing useful.
As Malik put it, the phrase “limited user data” is “particularly vague” and doesn’t help people “accurately judge the risk or take concrete action.”
Here’s what we still don’t know: how this happened, exactly how many accounts were affected, and why it took four months to detect.
As of publishing, Substack has posted nothing publicly about this.
They kept quiet. You don’t have to.
Your people need to know. Share it.
~ Kaifi.
–
Sources: