Substack confirms data breach affecting email addresses and phone numbers

Substack, the popular newsletter platform, has officially acknowledged a data breach that has affected its users. In a recent communication to its subscribers, the company revealed that an unauthorized third party gained access to certain user information in October. This breach included email addresses, phone numbers, and some unspecified internal metadata. In his message to users, Substack’s CEO Chris Best reassured that more sensitive data, such as credit card information and passwords, remained secure and unaffected. He explained that the company first identified the security vulnerability back in February, which allowed the breach to occur. Following this discovery, Substack has implemented fixes and initiated an investigation into the incident. “I’m reaching out to let you know about a security incident that resulted in the email address and phone number from your Substack account being shared without your permission,” Best expressed in the email. He conveyed his sincere apologies for the occurrence, emphasizing Substack’s commitment to protecting user data and privacy, which he admitted had not been met in this instance. Details surrounding the breach remain murky, including the exact nature of the system vulnerability and the extent of the compromised data. Furthermore, questions linger regarding the five-month delay in detecting the breach and whether any ransom demands were made by the hackers. While Substack has not disclosed the number of users impacted, they indicated that there is currently no evidence suggesting that the compromised data is being misused. However, they have urged users to be vigilant regarding unsolicited emails and texts. Substack boasts over 50 million active subscriptions, with 5 million of those being paid subscribers, a milestone achieved last March. The company also recently secured $100 million in Series C funding, led by BOND and The Chernin Group, alongside participation from notable investors such as a16z, Klutch Sports Group CEO Rich Paul, and Skims co-founder Jens Grede.