Substack Breach Exposes Email and Phone Data Amid Rapid Growth

Substack has confirmed a significant data breach affecting its user base, revealing that an unauthorized party accessed email addresses, phone numbers, and internal metadata from its systems last October. The newsletter platform, which reached 50 million active subscriptions last year, detected the intrusion in February 2025—four months after the initial compromise—and has since secured its systems.

In an email to users, CEO Chris Best acknowledged the breach: "I’m incredibly sorry this happened. We take our responsibility to protect your data seriously, and we came up short here." Notably, financial data including credit card details and passwords remained protected due to separate encryption protocols.

The disclosure raises operational questions about Substack's security infrastructure during its aggressive growth phase. With 5 million paid subscriptions fueling its model, the platform handles sensitive writer-reader relationships where email addresses serve as primary identifiers. Yet Substack hasn't clarified how many users were impacted or detailed the technical lapse that enabled the breach. Its vague statement about lacking "evidence of misuse" contrasts with industry standards where companies typically specify monitoring methods like log analysis.

This incident arrives amid Substack's continued expansion backed by substantial venture funding. In July 2025, the company closed a $100 million Series C round led by BOND and The Chernin Group, with participation from Andreessen Horowitz and high-profile angels like Skims co-founder Jens Grede. Investors have bet heavily on Substack's positioning as an alternative to ad-driven media, valuing its direct creator monetization approach.

For startups handling user data at scale, the breach illustrates recurring tensions between rapid growth and security diligence. Substack's five-month detection gap suggests potential gaps in real-time intrusion monitoring—a critical capability for platforms managing millions of contact points. While no ransomware demands have surfaced, the exposure of metadata could enable sophisticated phishing campaigns targeting Substack's community of writers and subscribers.

The company advises users to remain cautious about unsolicited communications but hasn't offered identity protection resources. As newsletter platforms increasingly compete for professional creators, this incident may accelerate demand for enhanced security features like multi-factor authentication and breach alerts—areas where Substack currently lags behind some competitors.