After the 2026 Substack Email and Phone Number Leak, What Should Users Do First?

You received a message about the Substack incident, or a sudden email or text is asking you to “secure” your account.

Fastest safe response: verify the notice through a route you already trust, check your account and any reused passwords, and treat follow-up messages with extra caution. An exposed email address alone usually does not mean you need to abandon your primary inbox.

This guide is for Substack subscribers who received a security notice, anyone who has received a suspicious message referring to the incident, and people who want to limit how often they share their primary email address.

What the Substack 2026 data breach reports do and don’t establish

Start by separating reported information from conclusions the available reporting does not support. A report published on February 5, 2026, said the incident involved users’ email addresses, phone numbers, and internal metadata that was not described in detail. The report did not identify passwords or payment information as affected data; that is not the same as a guarantee that every account or system was unaffected. Read the report on the incident and the data types it described as reporting, and check any direct notice or later announcement from Substack for official updates.

For your own decision, keep the evidence in three buckets:

• Reported as involved: email addresses, phone numbers, and unspecified internal metadata, according to the linked report.
• Not identified in that report as affected: passwords and payment information. Do not turn that limited statement into proof that your password is safe, especially if you reused it elsewhere.
• Still unknown from the cited report: how many people were affected, whether your specific record was accessed, what the internal metadata contained, and what anyone may do with the data. Do not treat claims about those details as confirmed unless an official update verifies them.

A message that mentions a real security incident can still be fraudulent. Scammers can copy public details, then add a fake login page, a request for a verification code, or a threat that your account will be closed. The existence of a reported incident makes verification more important, not less.

Does an exposed email address mean your primary inbox has been taken over? No. Exposure means the address may be known to someone who did not have it before. Account access is a separate question. Check your email account’s sign-in activity and recovery options directly, and respond to signs of unauthorized access rather than assuming exposure equals compromise.

When a notice arrives: verify before you click

Do not use a link in an unexpected message as your first route to an account. Open a browser or app you already use, enter the known official address yourself, and look for an announcement or account message there. If the notice asks you to act, compare its instructions with what you can see through that independent route.

Check the message itself as supporting evidence, not as proof:

• Inspect the full sender address. A familiar display name can be paired with an unrelated address.
• Preview the link destination without opening it. Look for misspellings, extra words, or a domain that does not match the official service.
• Treat unexpected attachments, password requests, verification-code requests, and payment requests as warning signs.
• Be wary of pressure such as “act immediately” or “your account will be deleted.” Urgency is not authentication.
• If a text message includes a link, do not assume it is legitimate just because it refers to your phone number or the reported incident.

The FTC’s guidance on recognizing phishing emails and texts explains why suspicious links, unexpected requests, and pressure tactics deserve scrutiny. If the message seems plausible but you cannot verify it independently, do not reply or provide information. Navigate to the service through a route you trust and contact support from there.

How can you check whether a Substack security notice is genuine? Verify it outside the message: sign in through your usual route or check an official announcement, then compare the requested action. A sender name, logo, or reference to the reported incident is not enough to establish authenticity.

During your first account check: look for access risks

Once you have verified the notice independently, check the Substack account and the email account that receives its messages. These are separate accounts, and each can have different security risks.

Start with the account you use for Substack:

• Confirm you can sign in through your usual route. Do not follow a message link to test your login.
• Review any available account activity or security settings for changes you do not recognize.
• If you find an unfamiliar session, unexpected account change, or sign-in alert, use the service’s official account recovery and security instructions.
• Review the email address and phone number connected to the account. Update them only through an authenticated account route you trust.
• If the account offers multi-factor authentication, consider enabling it. Substack’s two-factor authentication instructions explain how its feature works. For broader context, CISA’s multi-factor authentication advice explains why an additional authentication factor can help protect accounts.

Next, check for password reuse. If you used the same password for Substack and another service, change that password anywhere it was reused, starting with your email account and other accounts that could unlock further accounts. Use a different password for each service. If you cannot access your email account or see signs of unauthorized access, follow the account recovery guidance for a compromised email or social account.

Do not share a verification code with someone who contacts you unexpectedly. A legitimate-looking conversation does not make a request safe; an attacker who obtains a code may be able to use it during a sign-in or recovery attempt.

In the following days: screen for incident-themed phishing

After a public incident, a convincing scam may use accurate details from reporting and add a false next step. A message might claim that your account needs “re-verification,” that a security team must confirm your phone number, or that a payment method needs review. Treat the requested action as the main thing to verify.

What should you do with an email or text that mentions the Substack incident? Don’t reply, click a login link, open an unexpected attachment, or provide a password or code. Check the claim through a known official route. If you already entered credentials on a page opened from the message, change the affected password from a trusted route and review the account for unfamiliar access.

Use these checks whenever a related message arrives:

• Sender: Does the full sending address match the service’s known communication channel, or only its display name?
• Destination: Does the link lead to a domain you independently recognize? A visible label can conceal a different destination.
• Request: Is the message asking for your password, one-time code, payment details, or an unusual account change?
• Pressure: Does it create a deadline or threaten immediate loss of access without a way to verify the claim?
• Context: Does it ask you to sign in through a link even though you can check the account directly?

A plausible detail is not enough to pass these checks. Scammers can reuse public facts, so the strongest test is whether the same action appears through an independent official route. Save a copy of a suspicious message if you need to report it, but do not forward it to coworkers or family as a warning without noting that it is unverified.

Whether to replace your primary email

Do not replace your main address solely because it may have been exposed in this incident. Changing an address can create extra work, and it will not recall messages already sent or erase copies of data that others may have obtained. It can also complicate account recovery if you change it before confirming that your important accounts use current recovery details.

Consider a staged move only when there is a clear reason:

• Your primary email account has signs of unauthorized access, and you cannot restore control or secure its recovery methods.
• You face persistent, targeted harassment that makes the address itself difficult to keep using.
• You want a more deliberate separation between low-trust registrations and accounts tied to your identity, work, or finances.

If you decide to move, secure the old inbox first when possible. Update important accounts individually, confirm their recovery addresses, and retain access to the old address while services still depend on it. Do not rush to delete an account or mailbox that you may need for password resets, records, or support.

Do you need to change your email after the reported exposure? Usually not just because your address appears in a reported incident. Change it when you have an account-control problem, a persistent abuse problem, or a deliberate separation plan—not as a substitute for checking passwords and sign-in activity.

The advantage of keeping your existing address is continuity: fewer recovery changes and less risk of losing access to accounts you still need. The trade-off is that the address may continue to receive spam or impersonation attempts. If those messages become a problem, use your provider’s reporting and filtering tools, and avoid responding to suspicious senders. If you want to understand the broader options, compare masked and disposable addresses before deciding which type fits each account.

For future registrations: separate addresses by trust and importance

A leaked address cannot be recalled, but you can limit where you share your primary one from now on. Give high-trust services and accounts that need long-term recovery an address you can keep and secure. Use a separate address for low-trust sites, trials, newsletters, or registrations where you do not want your main inbox exposed.

Different approaches suit different needs:

• Primary email: Best for accounts that matter over time and may need recovery, such as financial, government, work, or health services. It requires good account security and careful spam management.
• A separate mailbox or email alias: Useful when you want an address you can keep, organize, or disable later. Check how recovery and forwarding work before relying on it for an important account.
• A temporary address: Useful for a short-lived registration or a one-time verification when you do not expect to recover the account later. It is a poor choice for accounts that require long-term access, financial or government notices, or ongoing replies.

An address strategy is not a way to undo a leak. It helps you reduce future exposure and may make it easier to identify which registration was associated with unwanted mail. For a more deliberate separation plan, see how to separate checkout and account email addresses.

Use this checklist when deciding what to do next:

• [ ] I checked the notice through an official route I opened myself.
• [ ] I avoided submitting a password, verification code, or payment detail through an unexpected message.
• [ ] I confirmed that I can sign in to the relevant account and reviewed the security information available to me.
• [ ] I changed any password that I reused on another service, starting with accounts that could help recover other accounts.
• [ ] I enabled available multi-factor authentication where it fits my account and recovery setup.
• [ ] I chose a durable address for any account that needs long-term recovery or important notices.
• [ ] I reserved temporary or low-trust addresses for registrations I can afford to lose access to.

If your email account itself appears compromised, address that before reorganizing registration addresses. A compromised inbox can be used to reset other accounts, so recovery and control take priority over convenience. If you are unsure how to assess that risk, follow the linked recovery guidance rather than responding to an unsolicited “security helper.”

A lower-exposure option for low-trust sign-ups

For a short-lived registration, trial, or one-time code, a temporary address can keep your primary email out of another site’s registration form and help prevent its routine messages from landing in your main inbox. It does not make you anonymous, protect an account whose password is reused, or remove an address already exposed in the reported incident.

Do not use a temporary address where you need durable access, account recovery, financial or government notices, or an ongoing reply channel. Those accounts need an address you control for the long term. If you are signing up for something disposable and do not need lasting access, TMPFox offers an option to keep that registration separate from your primary inbox; choose it for future exposure control, not as a fix for data already disclosed.