Media, News & Creative Apps · Publishing · Data breach
Substack
Headline
The February 2026 disclosure involved a third party exploiting a flaw - a confirmed and very recent breach.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The February 2026 disclosure involved a third party exploiting a flaw - a confirmed and very recent breach. The structural point specific to Substack is that a subscription newsletter list is simultaneously a customer list, a payment record and a political or interest profile, and it belongs to a writer who is usually an individual with no security capability at all. Substack's central infrastructure means one breach reaches every publication on it at once. For a reader, subscribing to a newsletter is a more revealing act than subscribing to a magazine ever was, because the list is queryable.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
CONFIRMED, VERY RECENT BREACH (Feb 2026 disclosure): a third party exploited a vulnerability in Substack's API (a 'scraping' attack, not a traditional server break-in) in October 2025, and Substack did not detect it until February 3, 2026 — roughly a FOUR-MONTH gap. Substack confirmed that email addresses, phone numbers and internal metadata were exposed; the hacker claims about 697,000 records (Substack has not confirmed the count), and analysis of the leaked data reportedly also found names, profile pictures, bios and Stripe platform customer IDs — security researchers specifically flagged that pairing email + phone number is 'critical data' in an era of SIM-swap attacks, even without passwords/financial data exposed directly. The stolen dataset was posted for sale on BreachForums by an actor using the alias 'w1kkid.' Substack CEO Chris Best publicly apologized, acknowledging the company 'came up short' on its data-protection responsibility.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy substack.com/privacy | Not fetched yet | NO (HTML only) |
| Terms of service substack.com/tos | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.