Substack Scrape 2025

We noticed a significant data aggregation appearing on a well-known cybercrime marketplace in early February 2026, raising immediate concerns. This dataset, purportedly a comprehensive scrape of the US-based creator monetization platform Substack, presented a substantial volume of user information. What struck us was the detailed nature of the data, extending beyond basic contact information to include financial identifiers. The timeframe indicated by Substack suggests a latent period between the actual compromise and its public disclosure, a common tactic to allow for initial exploitation before detection.

The breach, identified as a database scrape, originated from an incident in October 2025. The publicly available dataset, titled "Substack Scrape 2025," contained 662,679 records, with a notable 662,679 unique email addresses. Accompanying these were associated usernames and phone numbers. Crucially, the leak also included Stripe IDs, a sensitive financial identifier that significantly elevates the risk profile for affected individuals. The source structure indicates a direct extraction from Substack's user database, bypassing typical access controls. The leak location was a prominent cybercrime forum, suggesting an intent to monetize or distribute the compromised information broadly.

While specific news coverage directly linking this scrape to major outlets was limited at the time of its appearance, the nature of the platform and the data types involved would likely attract attention from cybersecurity news aggregators and threat intelligence platforms. OSINT analysis of the cybercrime forum where the data surfaced revealed discussions about the legitimacy and potential uses of the dataset, including phishing campaigns and identity theft. Research into previous platform-specific data exposures, while not directly analogous, highlights the persistent threat of credential stuffing and account takeover attempts targeting users of popular online services.