Breaches
1
1 verified
Records Exposed
663K
Total across all breaches
Data Types Leaked
2
0 high risk
Latest Breach
2025
Substack
Breach History
Substack
Oct 2025High
663.1K
Records exposed
2
Data types leaked
Verified
Status
In October 2025, the publishing platform Substack suffered a data breach that was subsequently circulated more widely in February 2026. The breach exposed 663k account holder records containing email addresses along with publicly visible profile information from Substack accounts, such as publication names and bios. A subset of records also included phone numbers.
Exposed Data Types
Email addressesPhone numbers
Policy Issues
- The company claims no automated decision-making or profiling, but explicitly states it uses profiling to suggest content.
- The company does not claim universal data encryption and explicitly states that direct messages are not end-to-end encrypted.
- The company claims not to share data with third parties at all, but explicitly lists sharing with service providers for operational purposes.
- The company claims not to share data with third parties at all, but the policy indicates involvement in or facilitation of interest-based advertising, which typically involves sharing with advertisers or ad networks.
- The company claims not to share data with third parties at all, but explicitly lists sharing with a broad range of third parties including affiliates, creators, service providers, other data controllers, other users, prospective buyers/sellers, and government authorities.
Incident Status
Data breachYes
Data brokerNo
Policy contradictionsYes
Exposed Data Types
Email addressesLow risk
Phone numbersMedium risk