Substack recently confirmed a data breach affecting user information. The incident, which occurred in February 2026, exposed user email addresses and phone numbers. According to an email from Substack CEO Chris Best, the company identified and fixed the issue. The breach highlights the ongoing challenges that online platforms face in securing user data and raises questions about their security protocols.

The breach's scope and the exact cause remain unclear. While Substack stated that more sensitive data like credit card details and passwords were unaffected, the delay in detecting the incident is concerning. The company has not disclosed the number of affected users or the technical details of the vulnerability. This lack of transparency has led to speculation and concerns among users regarding data security.

Substack's response to the breach includes an apology and a recommendation for users to exercise caution. The company has not provided specific technical details on how it will prevent future incidents. The article also references the TechCrunch Founder Summit 2026 in Boston, suggesting that Substack's leadership may address the issue there. Users should remain vigilant against potential phishing attempts.

The incident underscores the importance of robust security measures for platforms handling user data. The lack of detailed information from Substack leaves users with uncertainty. The breach's impact extends beyond the immediate compromise of personal information, potentially affecting user trust and the platform's reputation. Transparency and swift action are crucial in restoring confidence.

Quick Fact: Substack currently boasts over 50 million active subscriptions, including 5 million paid subscriptions.