{ "type": "bundle", "id": "bundle--43fd512e-3fc3-5206-8492-40a9be56adab", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--c056b7c8-b2eb-50f4-8c69-147d83a92081", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "org:1b5fe840-fb26-45f2-8b55-2497250c483c", "name": "Substack, Inc.", "identity_class": "organization" }, { "type": "incident", "spec_version": "2.1", "id": "incident--22f477b6-f399-5086-8f71-fda5cfbbf24b", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "inc:64e16f2d-46ad-4944-a209-8e552d5f52a0", "name": "October 2025 Substack unauthorized-access incident" }, { "type": "incident", "spec_version": "2.1", "id": "incident--43d1ea40-414a-5200-81d2-f8d3f5c2418d", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "brh:2cecf62a-87b6-486e-ab83-45a96d600a09", "name": "Substack user contact-data breach" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--16e74e13-c84e-5ada-8db7-9eaf024a77ad", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "clm:fe7cfff5-7ce8-462c-bcc7-5d8b11a22503", "relationship_type": "exposed-data-category", "source_ref": "x-ally-data-exposure--c78ca67f-4d98-5fce-8483-0892a9398f07", "target_ref": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231", "confidence": 100, "external_references": [ { "source_name": "TechCrunch", "url": "https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/", "external_id": "cit:8a6f86d2-27ba-49ec-ac13-30162b1ef4ad", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4d14aa65b60014e832505c49190970ebc79ccdfeb51574a79546a580fc484157" }, { "source_name": "Have I Been Pwned", "url": "https://haveibeenpwned.com/api/v3/breach/Substack", "external_id": "cit:2d6562fa-dd11-4dc0-b8db-b1d5538af647", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:bca2a84b02277bc0618b0192c5991ad83e3340115e1a2e29f903ed5eadeae4f6" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--52d7874b-c423-535a-8990-9634dbe38353", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "clm:65f28de8-802b-4d18-8ee2-059b1ff482f3", "relationship_type": "affected-organization", "source_ref": "incident--22f477b6-f399-5086-8f71-fda5cfbbf24b", "target_ref": "identity--c056b7c8-b2eb-50f4-8c69-147d83a92081", "confidence": 100, "external_references": [ { "source_name": "TechCrunch", "url": "https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/", "external_id": "cit:acbc4672-4493-4154-ae38-a1789ee9dcf2", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4d14aa65b60014e832505c49190970ebc79ccdfeb51574a79546a580fc484157" } ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8c685873-28e1-5064-8aae-77cef5787012", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "clm:fda9554e-03c9-49ec-8099-aed0cdb46af3", "relationship_type": "resulted-in", "source_ref": "incident--22f477b6-f399-5086-8f71-fda5cfbbf24b", "target_ref": "x-ally-data-exposure--c78ca67f-4d98-5fce-8483-0892a9398f07", "confidence": 100, "external_references": [ { "source_name": "TechCrunch", "url": "https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/", "external_id": "cit:cea7db7e-c98d-4721-af0d-1ffff7c1115d", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4d14aa65b60014e832505c49190970ebc79ccdfeb51574a79546a580fc484157" } ] }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--11619376-f621-56bc-8843-70acac0fac22", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "clm:bdd0f30f-8f49-4c30-b3aa-2d8c43a0c475", "confidence": 100, "external_references": [ { "source_name": "TechCrunch", "url": "https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/", "external_id": "cit:164f11f0-022a-4bfd-b184-b756d5e0eb6e", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4d14aa65b60014e832505c49190970ebc79ccdfeb51574a79546a580fc484157" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Substack said it identified the issue in February 2026, fixed the problem, and began an investigation." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--1e54ba70-c693-5c38-8c22-a4cb58993c1b", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "clm:cafde134-1c02-4b3f-9f19-72d691ad5617", "confidence": 100, "external_references": [ { "source_name": "TechCrunch", "url": "https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/", "external_id": "cit:72e306de-0381-47ff-a314-1c5e5f6247a4", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4d14aa65b60014e832505c49190970ebc79ccdfeb51574a79546a580fc484157" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Substack said credit-card numbers, passwords, and other financial information were unaffected." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--339addc8-9255-56b4-8fbf-c5288e80f1ba", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "clm:67673b55-0a4a-4301-b4fe-47ca9eb23398", "confidence": 100, "external_references": [ { "source_name": "TechCrunch", "url": "https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/", "external_id": "cit:b45de72d-2b1a-4eec-a4a2-1eace8f77aed", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4d14aa65b60014e832505c49190970ebc79ccdfeb51574a79546a580fc484157" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Substack said it had no evidence that user data was being misused and advised users to be cautious with emails and texts." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--33b93b99-8697-5f91-8a14-a2f76e80e892", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "clm:5233fdd9-f4a8-48fe-8d72-df01abaab387", "confidence": 100, "external_references": [ { "source_name": "Have I Been Pwned", "url": "https://haveibeenpwned.com/api/v3/breach/Substack", "external_id": "cit:50724094-2ca6-4a3b-9c45-5bafaf2f447a", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:bca2a84b02277bc0618b0192c5991ad83e3340115e1a2e29f903ed5eadeae4f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "integer", "value": 663121, "unit": "record" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--61137dec-9108-545b-8e83-e205b2c4fcd0", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "clm:7ea36994-5eb1-4a2a-9f9f-16c42fe2ff93", "confidence": 100, "external_references": [ { "source_name": "TechCrunch", "url": "https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/", "external_id": "cit:b97c7fbb-742f-444e-a199-c18643b20cd8", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4d14aa65b60014e832505c49190970ebc79ccdfeb51574a79546a580fc484157" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2026-02-05" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--821da4f6-cf3e-54b2-8041-9269e31016bb", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "clm:3aee9d9a-d530-4830-a2a2-95bcefe16050", "confidence": 80, "external_references": [ { "source_name": "Have I Been Pwned", "url": "https://haveibeenpwned.com/api/v3/breach/Substack", "external_id": "cit:fc6b2699-51c7-4a96-a146-a23fe05315f5", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:bca2a84b02277bc0618b0192c5991ad83e3340115e1a2e29f903ed5eadeae4f6" }, { "source_name": "TechCrunch", "url": "https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/", "external_id": "cit:9852ef48-dc4f-46c1-9d79-1e2cc3357f36", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4d14aa65b60014e832505c49190970ebc79ccdfeb51574a79546a580fc484157" } ], "x_ally_claim_object": { "kind": "value", "datatype": "date", "value": "2025-10-23" } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--b18922a6-8cb3-57ee-864e-6cd7bc289003", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "clm:b2146aff-e4c6-446f-b239-ff1caa86f0ff", "confidence": 100, "external_references": [ { "source_name": "TechCrunch", "url": "https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/", "external_id": "cit:4109246c-45d7-40e3-9ae0-f3194ee8237c", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4d14aa65b60014e832505c49190970ebc79ccdfeb51574a79546a580fc484157" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Substack said an unauthorized third party accessed limited user data without permission after an issue allowed access to parts of its systems." } }, { "type": "x-ally-claim", "spec_version": "2.1", "id": "x-ally-claim--e590a8a9-6ace-5975-821d-84ff754bb72b", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "clm:a23c5808-627f-4550-826b-7a061d0e635d", "confidence": 90, "external_references": [ { "source_name": "TechCrunch", "url": "https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/", "external_id": "cit:b25cc933-9a7a-4255-be81-e95554d1e398", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:4d14aa65b60014e832505c49190970ebc79ccdfeb51574a79546a580fc484157" }, { "source_name": "Have I Been Pwned", "url": "https://haveibeenpwned.com/api/v3/breach/Substack", "external_id": "cit:345625fb-3114-4166-890c-4ca404a12d51", "x_ally_stance": "supports", "x_ally_snapshot_id": "snp:sha256:bca2a84b02277bc0618b0192c5991ad83e3340115e1a2e29f903ed5eadeae4f6" } ], "x_ally_claim_object": { "kind": "value", "datatype": "string", "value": "Substack said other unspecified internal metadata was accessed; HIBP described public profile information such as publication names and bios in its corpus." } }, { "type": "x-ally-data-category", "spec_version": "2.1", "id": "x-ally-data-category--c79f34f3-405d-57d2-8409-98eff3898231", "created": "2026-08-08T23:12:00Z", "modified": "2026-08-08T23:12:00Z", "x_ally_original_id": "dat:5abcee7e-4a37-494a-b6ba-87ff46149be9", "name": "Contact information" }, { "type": "x-ally-data-exposure", "spec_version": "2.1", "id": "x-ally-data-exposure--c78ca67f-4d98-5fce-8483-0892a9398f07", "created": "2026-08-09T09:09:13Z", "modified": "2026-08-09T09:09:13Z", "x_ally_original_id": "exp:9b362553-d878-4323-af75-486905c0fdf6", "name": "Substack user contact and profile-metadata exposure" } ] }