[witnessme]

I am still confused for days whether this is a real news or a hoax. Only a substack user saying they received this email. I did not. And there is no official statement by Substack. What is really going on here?

[parable]

I've seen the leaked data posted on forums. I'm assuming they're trying to minimize the bad PR from this incident by only doing what's legally required, which is to notify affected users. They're likely not obligated to notify the broader public. Whether they should be obligated to do so is another discussion entirely.

[meitham]

Could you please tell me which forum this was posted on

[ntoskrnl_exe]

According to Have I Been Pwned, 663 thousand accounts were in the breach. You can verify your address there.

[proactivesvcs]

It recently popped up on the HIBP feed; they tend to be pretty careful when checking the veracity of claims.

https://haveibeenpwned.com/Breach/Substack

[ochronus]

I don't think it's fake - it explains why suddenly I got a ton of "verify your registration to XYZ" emails in the past week.

[Mordisquitos]

Do you reside outside of the EU (and outside anywhere where GDPR equivalents are enforced)? Maybe that would explain it.

Under GDPR, a business has the obligation to inform users if they have been affected by a data breach. That could hypothetically explain why Substack would inform some users (those protected by GDPRish legislation) while keeping it quiet towards the rest of them.

[GeorgeOldfield]

it's real, i have the leak.