3 comments

  • dickiedyce2 hours ago
    Ooopsie... possibly a problem for some folks: <a href="https:&#x2F;&#x2F;www.theguardian.com&#x2F;media&#x2F;2026&#x2F;feb&#x2F;07&#x2F;revealed-how-substack-makes-money-from-hosting-nazi-newsletters" rel="nofollow">https:&#x2F;&#x2F;www.theguardian.com&#x2F;media&#x2F;2026&#x2F;feb&#x2F;07&#x2F;revealed-how-s...</a>
    • versavolt1 hour ago
      Don’t “folks” me. I don’t give a darn.
  • witnessme3 hours ago
    I am still confused for days whether this is a real news or a hoax. Only a substack user saying they received this email. I did not. And there is no official statement by Substack. What is really going on here?
    • parable2 hours ago
      I&#x27;ve seen the leaked data posted on forums. I&#x27;m assuming they&#x27;re trying to minimize the bad PR from this incident by only doing what&#x27;s legally required, which is to notify affected users. They&#x27;re likely not obligated to notify the broader public. Whether they <i>should</i> be obligated to do so is another discussion entirely.
      • meitham1 hour ago
        Could you please tell me which forum this was posted on
        • parable18 minutes ago
          I&#x27;m fairly sure even mentioning the name of the forum isn&#x27;t allowed on HN. It should be trivial to find it yourself, though. I also replied to someone else with the CSV headers if you&#x27;re only trying to find out what exactly was included in the leak: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=46932380">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=46932380</a>
  • slopusila3 hours ago
    &gt; including email addresses, phone numbers, and other unspecified “internal metadata.”<p>&gt; Substack specified that more sensitive data, such as credit card numbers, passwords, and other financial information, was unaffected.<p>I hate it when companies do this.<p>passwords and credit card numbers are easily changed.<p>names, emails and phone numbers are not.
    • parable8 minutes ago
      I&#x27;d edit my other reply to this comment but can&#x27;t anymore.<p>Here are the columns from the CSV file I&#x27;ve seen being shared around on forums, including the &quot;internal metadata&quot;. This mostly boils down to full name on file, email, Stripe customer ID, activity metrics, usernames, and phone numbers. Everything else is largely irrelevant.<p>id,name,email,email_confirmed,email_confirmation_token,stripe_platform_customer_id,is_global_admin,is_ghost,created_at,anonymous_id,email_bounce_count,photo_url,publisher_agreement_accepted_at,bio,updated_at,profile_set_up_at,tos_accepted_at,email_digest_at,has_passed_captcha,import_confirmation_required,post_notification_preference,reader_installed_at,activity_items_viewed_at,dismissed_ios_app_promo_at,email_notifications_last_resumed_at,previous_name,release_group,handle,phone,bank_payment_failures,is_globally_banned,session_version
    • parable2 hours ago
      This is what I&#x27;ve been saying for years. I really could care less if my passwords were leaked. My phone number, on the other hand, is near-impossible to change. The fact that VoIP&#x2F;virtual numbers are blacklisted from use almost everywhere doesn&#x27;t help anything, because otherwise I would just use a ton of cheap rented numbers.<p>The same goes for full names on file, physical addresses, and other hard-to-change information. Passwords have been the least of my concerns since password managers were invented.<p>You could, in theory, use a custom domain or email aliasing service like SimpleLogin or Addy to combat the email address issue, though websites like GitHub have been known to block emails created with an aliasing service. I could go on about why that move does next to nothing to combat actual abuse; any spammer worth their salt can just buy a bunch of Gmail accounts or Outlook accounts instead.
      • hikkerl2 hours ago
        &gt;I really could care less if my passwords were leaked<p>couldn&#x27;t*
        • UqWBcuFx6NV4r48 minutes ago
          Please stop. This is a very common saying, despite its technical inaccuracy. I know that you know this. We don’t have to relitigate it.
    • praptak1 hour ago
      Phone numbers are kinda concerning given their popularity as 2FA. A phone number is now basically your shared password for everything. It&#x27;s also semi public, hard to change and you are basically one SIM swap attack away from a full compromise.