Volksgemeinschaft is a German expression meaning "people's community", "folk community", "national community", or "racial community", depending on the translation of its component term Volk.
Looked up NatSocToday on Substack, and they do have the swastika as a banner; they don't even hide or be subtle about it. Full on nazi, in plain sight.
I am still confused for days whether this is a real news or a hoax. Only a substack user saying they received this email. I did not. And there is no official statement by Substack. What is really going on here?
I've seen the leaked data posted on forums. I'm assuming they're trying to minimize the bad PR from this incident by only doing what's legally required, which is to notify affected users. They're likely not obligated to notify the broader public. Whether they should be obligated to do so is another discussion entirely.
Do you reside outside of the EU (and outside anywhere where GDPR equivalents are enforced)? Maybe that would explain it.
Under GDPR, a business has the obligation to inform users if they have been affected by a data breach. That could hypothetically explain why Substack would inform some users (those protected by GDPRish legislation) while keeping it quiet towards the rest of them.
This is what I've been saying for years. I really could care less if my passwords were leaked. My phone number, on the other hand, is near-impossible to change. The fact that VoIP/virtual numbers are blacklisted from use almost everywhere doesn't help anything, because otherwise I would just use a ton of cheap rented numbers.
The same goes for full names on file, physical addresses, and other hard-to-change information. Passwords have been the least of my concerns since password managers were invented.
You could, in theory, use a custom domain or email aliasing service like SimpleLogin or Addy to combat the email address issue, though websites like GitHub have been known to block emails created with an aliasing service. I could go on about why that move does next to nothing to combat actual abuse; any spammer worth their salt can just buy a bunch of Gmail accounts or Outlook accounts instead.
I'd edit my other reply to this comment but can't anymore.
Here are the columns from the CSV file I've seen being shared around on forums, including the "internal metadata". This mostly boils down to full name on file, email, Stripe customer ID, activity metrics, usernames, and phone numbers. Everything else is largely irrelevant.
Phone numbers are kinda concerning given their popularity as 2FA. A phone number is now basically your shared password for everything. It's also semi public, hard to change and you are basically one SIM swap attack away from a full compromise.
Phone number login in 2026 is really just asking for someone to do a SIM swap attack on the victim's account to steal their identity.
Surely a list of services that allow phone number logins exists so that one can avoid signing up in the first place and we would then see it in another connecting breach.
cant we just take it as a given that since the entire internet is scraped every 4hr's an 10 min, and then ransacked by every AI big tech, nation state, and the over achiving geeks have at there disposal, and therefore there is nothing that isn't "breached", multiply, and updated?, upbreached! daily.
The AI agents are throwing another party celebrating over yet another data breach where they can train on this data and can now get to know us even more for personalized conversations about our Substack activity.
dickiedyce|22 days ago
lostlogin|22 days ago
A very specific folk.
Volksgemeinschaft is a German expression meaning "people's community", "folk community", "national community", or "racial community", depending on the translation of its component term Volk.
https://en.wikipedia.org/wiki/Volksgemeinschaft
BiteCode_dev|22 days ago
And plot twist, they are anti-Trump.
I'm overwhelmed.
versavolt|22 days ago
[deleted]
witnessme|22 days ago
parable|22 days ago
ntoskrnl_exe|22 days ago
proactivesvcs|22 days ago
https://haveibeenpwned.com/Breach/Substack
ochronus|22 days ago
Mordisquitos|22 days ago
Under GDPR, a business has the obligation to inform users if they have been affected by a data breach. That could hypothetically explain why Substack would inform some users (those protected by GDPRish legislation) while keeping it quiet towards the rest of them.
GeorgeOldfield|21 days ago
slopusila|22 days ago
> Substack specified that more sensitive data, such as credit card numbers, passwords, and other financial information, was unaffected.
I hate it when companies do this.
passwords and credit card numbers are easily changed.
names, emails and phone numbers are not.
parable|22 days ago
The same goes for full names on file, physical addresses, and other hard-to-change information. Passwords have been the least of my concerns since password managers were invented.
You could, in theory, use a custom domain or email aliasing service like SimpleLogin or Addy to combat the email address issue, though websites like GitHub have been known to block emails created with an aliasing service. I could go on about why that move does next to nothing to combat actual abuse; any spammer worth their salt can just buy a bunch of Gmail accounts or Outlook accounts instead.
parable|22 days ago
Here are the columns from the CSV file I've seen being shared around on forums, including the "internal metadata". This mostly boils down to full name on file, email, Stripe customer ID, activity metrics, usernames, and phone numbers. Everything else is largely irrelevant.
id,name,email,email_confirmed,email_confirmation_token,stripe_platform_customer_id,is_global_admin,is_ghost,created_at,anonymous_id,email_bounce_count,photo_url,publisher_agreement_accepted_at,bio,updated_at,profile_set_up_at,tos_accepted_at,email_digest_at,has_passed_captcha,import_confirmation_required,post_notification_preference,reader_installed_at,activity_items_viewed_at,dismissed_ios_app_promo_at,email_notifications_last_resumed_at,previous_name,release_group,handle,phone,bank_payment_failures,is_globally_banned,session_version
praptak|22 days ago
rvz|22 days ago
Surely a list of services that allow phone number logins exists so that one can avoid signing up in the first place and we would then see it in another connecting breach.
BiteCode_dev|22 days ago
A friend of mine received a very well-crafted physical letter at his home about resetting his cryto ledger.
He is now very stressed because there are news about people with crypto getting abducted.
And with the ledger leak they have:
- his name and address
- how much money he has on his ledger
metalman|22 days ago
rvz|22 days ago
chrisjj|22 days ago
iamacyborg|22 days ago
parable|22 days ago
ArchieScrivener|22 days ago
genie3io|22 days ago
[deleted]