Substack Was Hacked in October 2025. It was confirmed in 3 February 2026 by CEO Christ Best. Here is What You Need to Know Based on An Interview with Dr Mehmet Yildiz, Chief Editor of ILLUMINATION Publications on Medium and Substack to Understand the Situation
Curator’s Note: In February 2026, Substack CEO Chris Best confirmed a hack that occurred in October 2025, compromising limited personal data such as email addresses and phone numbers, although financial information remained secure. Dr. Mehmet Yildiz, Chief Editor of ILLUMINATION Publications, discussed the implications of this breach, emphasizing the need for transparency and responsible communication from platforms. He highlighted how exposed data may lead to social engineering scams and advised users to act cautiously post-breach. Yildiz encourages creators to maintain digital identity awareness as part of a responsible approach to data stewardship, advocating for calm vigilance in the face of potential risks. This post aims to inform our community and invite you to take necessary measures to keep your accounts safe on Substack and prevent cybersecurity risks.
Dear Subscribers,
Happy Weekend! We trust this post finds you well today. In this article, we want to share our interview on a recent incident on Substack to inform you and create awareness in our writing and reading community.
When platforms grow into global publishing ecosystems, trust becomes their most valuable infrastructure.
Yesterday, Substack’s CEO, Chris Best, sent a direct and candid email to users acknowledging a security incident involving limited personal data. The message was clear, apologetic, and specific.
Email addresses, phone numbers, and internal metadata were accessed without permission due to a system issue identified earlier this month. Financial data, passwords, and credit card information were explicitly unaffected.
While such data may appear limited, even partial personal information can enable convincing impersonation and targeted social engineering when combined with other sources.
For many creators, this message understandably triggered concern, stress, confusion, and emotional strain. Moments like these can affect mental well-being, especially for people whose work, income, and sense of community are closely tied to digital platforms.
Beyond the immediate news, deeper questions naturally arise:
What does “limited data” truly mean in an era of sophisticated cybercrime? How are such incidents typically exploited over time? And how can individuals respond thoughtfully and protect themselves without slipping into panic, denial, or unnecessary self-blame?
Purpose of the Interview
To explore these questions with clarity and depth, we spoke with Dr Mehmet Yildiz, founder and chief editor of ILLUMINATION publications on Substack and Medium, a long-time technology executive, systems thinker, and cybersecurity-aware educator.
Dr Yildiz also brings lived experience. In 2022, following a healthcare data breach unrelated to Substack, his personally identifiable information was later abused by highly sophisticated scammers, resulting in significant financial loss as he documented on this platform in 2022 in a story titled Here’s Why I Called a Lifeline for the First Time in My Life Today.
This interview aims to inform rather than alarm, to explain rather than speculate, and to help creators understand how to think about data, trust, and digital responsibility in an increasingly adversarial environment.
10 Questions from the ILLUMINATION Editorial Team to Illuminate the Substack Security Incident
1. Editors:
Substack’s CEO described the incident as a failure to fully protect user data and offered a direct apology. From your perspective, how should creators interpret this message?
Dr Yildiz:
I see this as a responsible communication. The email acknowledges the failure without defensiveness, explains the scope, and avoids minimization. This executive-level communication matters as security incidents are systemic events, not moral failures. What builds trust is transparency, accountability, and corrective action. This message provides those elements and sets a constructive tone for users to respond rationally rather than emotionally.
2. Editors:
The email emphasizes that no passwords, credit cards, or financial data were accessed. Why is this distinction important?
Dr Yildiz:
Because it accurately defines the threat surface. Cybersecurity risk involves what data is exposed and how it can be misused. While financial credentials enable immediate damage, contact information and metadata enable delayed, psychological, and social engineering attacks. Understanding the difference helps people respond proportionately rather than assuming the worst.
3. Editors:
The data was accessed months earlier, in October 2025, but identified in February. Is that delay unusual?
Dr Yildiz:
Unfortunately, no. Many breaches are discovered long after initial access. Detection usually depends on subtle anomalies rather than alarms. This is why modern security focuses as much on monitoring and response as on prevention. The key point is what happens after discovery, and Substack has clearly stated that the system issue has been fixed and is under full investigation.
4. Editors:
You often refer to breaches as “lifecycle events” in your cybersecurity articles and book chapters. Can you explain what that means in this context?
Dr Yildiz:
A breach does not end when access stops. Data can circulate quietly, be aggregated with other sources, and surface later in highly convincing scams. For example, attackers may wait months before using such data, contacting people during moments of stress or transition when vigilance is naturally lower. In my own case, the financial damage came much later, when attackers used accurate personal context to build trust with a financial institution. That is why awareness must persist beyond the initial news cycle.
5. Editors:
Substack says there is no evidence of misuse so far. How should people interpret that statement?
Dr Yildiz:
It should be read as factual, not predictive. Absence of evidence today does not guarantee absence of future attempts. At the same time, it does not justify fear. It simply means users should exercise calm vigilance, especially with unsolicited emails or messages that reference Substack, publishing, or urgency. In my experience, periods following publicized breaches generally coincide with an increase in suspicious messages. This reinforces the value of sustained awareness.
6. Editors:
What types of scams typically follow exposure of email addresses and phone numbers?
Dr Yildiz:
The most common are impersonation and pretexting. Messages may appear to come from platforms, collaborators, or support teams. They typically rely on timing and emotional triggers rather than technical sophistication. Attackers succeed when people feel rushed, flattered, or alarmed.
7. Editors:
Substack encouraged users to be cautious with suspicious emails and texts. What does “caution” look like in practice?
Dr Yildiz:
It means slowing down and verifying before responding. It also means avoiding links or attachments from unexpected messages and using separate channels to confirm legitimacy. Security can improve dramatically when people pause for even thirty seconds. Attackers depend on speed, not intelligence.
8. Editors:
Some creators worry that repeated incidents across platforms signal a losing battle. How do you respond to that concern?
Dr Yildiz:
I disagree with the framing. Digital platforms operate in contested environments, much like cities or financial systems. Risk does not imply failure. It implies responsibility. What matters is how platforms learn, adapt, and communicate. Substack’s response demonstrates awareness of that responsibility.
9. Editors:
From an institutional perspective, what should platforms learn from incidents like this?
Dr Yildiz:
That data stewardship extends beyond storage. It includes communication, empathy, and user education. When people understand what happened and what it means, they become partners in resilience rather than passive victims.
10. Editors:
If you could offer one guiding mindset to creators reading this, what would it be?
Dr Yildiz:
Treat your digital identity as something that outlives any single platform. Stay informed, calm, and deliberate. Awareness without fear is the strongest form of security.
Our thanks to Dr Mehmet Yildiz for sharing his time and insights at short notice. We hope this conversation helps readers better understand the nature of security incidents and approach them with clarity, awareness, and calm vigilance.
We will be sharing our next monthly update this weekend through our bulletins and newsletters. Thank you for reading and for staying engaged with the ILLUMINATION community.
Here is the link January updates if you missed it:
January 2026 Updates by ILLUMINATION Integrated Publications
Submission Guidelines, New Publications, and Plans for 2026medium.com
Please check out our onboarding pack to learn about our publications.
Master Copy for 2025: Onboarding Information for New Writers of ILLUMINATION Integrated…
Welcome and information pack for new contributors to our supportive Publications on Medium, now integrating with…medium.com
You can learn about our editors from this collection:
Collection of Editor Profiles
Meet Editors of Illumination Integrated Publicationsmedium.com
For external links and connections of our publications you can check out this page:
Medium.Com Publications by Digitalmehmet — The Digitalmehmet Content Ecosystem
Digitalmehmet Content Ecosystem Owns and Manages 17 Publications on Medium.com for ILLUMINATION community for free.digitalmehmet.com
Invitation to New Writers
We would be delighted if you could join us. We support over 41,000 writers on Medium and many thousands on Substack. To join our vibrant publications, please send a request via this link. We will help you gain visibility and succeed as a writer on Medium. Please point out the publication name with your Medium account ID in the request. Readers can read thousands of stories and writers can monetize self-published content. Get an email whenever ILLUMINATION publishes.
References:
Substack Was Hacked, and This Is What You Need to Know
What Creators Should Know About the Recent Substack Security Incident
Leave a Reply