Substack Data Breach (2025)

On October 23, 2025, the newsletter platform Substack experienced a data breach that later circulated more widely in February 2026, exposing records of 663,000 account holders.

What Public Reporting Shows

Public reporting from Have I Been Pwned indicates the breach included email addresses for all affected accounts along with publicly visible profile information such as publication names and bios. A subset of the records also contained phone numbers. The incident was first recorded in October 2025, with the data appearing in broader circulation the following February. No evidence has surfaced that payment details, passwords, or private message content were taken. The total number of unique records stands at 663K, making it a significant but not catastrophic exposure of contact and identity details.

Why This Matters for You and Your Family

When your email address and phone number leave a controlled environment, they become building blocks for spam, phishing campaigns, and more targeted attacks against you and anyone linked to your accounts. For families this can mean children’s linked accounts or shared contact details suddenly sitting in unknown hands. The exposure of publication names and bios adds context that helps attackers craft convincing messages. Once this data reaches underground forums, it rarely disappears. You and your family remain at elevated risk for weeks, months, or years after the initial breach.

February 2026 marks the point when the dataset moved beyond the initial incident into wider distribution, increasing the chance it has already reached individuals who intend to misuse it.

The Doxxing and Identity-Chain Implications

Email addresses and phone numbers serve as anchors that tie together usernames, social profiles, and real-world identities. Attackers routinely combine this information with data from other breaches to build detailed pictures of targets. A Substack publication name or bio can reveal interests, locations, or affiliations that make social engineering easier. In households where the same email handles both adult newsletters and children’s gaming sign-ups, one leak can cascade into multiple account takeovers. Public reporting indicates these chains often lead to doxxing attempts, harassment, or extortion once a full identity profile is assembled.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the included cleanup of Warden to remove what you can.
• Rotate the password used on Substack anywhere it is reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same contact details.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles on your behalf.

Protecting yourself no longer ends with changing one password. The speed and persistence of identity-based attacks require ongoing vigilance and expert support. DoxxScan by GalaxyWarden delivers that through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting your DoxxScan trial today gives you and your family a practical defense against the next wave of leaks that inevitably follow incidents like Substack’s.