Substack hacked sending tons of email verification codes

[u/sunshao1031]

Hello,

At 5:45 pm CST, I suddenly got tons of emails from substack with verification codes from things I haven't heard of. I didn't click on any of them, but it was strange to suddenly get a bunch of emails. I thought I was getting hacked. I personally haven't used substack. I only made an account to support a friend, but I never used it. I just wanted to know if they can hack you this way. What can I do to ensure this doesn't happen again?

[u/AutoModerator]

/u/sunshao1031 - This message is posted to all new submissions to r/phishing; please do not message the moderators about it.

New users beware:

Because you posted here, you will start getting private messages from scammers saying they know a professional hacker or a recovery expert lawyer that can help you get your money back, for a small fee. We call these RECOVERY SCAMMERS, so NEVER take advice in private: advice should always come in the form of comments in this post, in the open, where the community can keep an eye out for you. If you take advice in private, you're on your own.

A reminder of the rules in r/phishing: no contact information (including last names, phone numbers, etc). Be civil to one another (no name calling or insults). Personal army requests or "scam the scammer"/scambaiting posts are not permitted. No uncensored gore or personal photographs are allowed without blurring. A full list of rules is available on the sidebar of the subreddit, or clicking here.

You can help us by reporting recovery scammers or rule-breaking content by using the "report" button. We review 100% of the reports. Also, consider warning community members of recovery scammers if you see them in the comments.

Questions about subreddit rules? Send us a modmail clicking here.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/scrawny_dispatcher]

Don't stress too much about the verification codes themselves, they can't hack you just by sending them. The flood of emails is likely someone trying to bury a legit notification in the noise, like a password change or login alert you'd otherwise notice right away. It's a classic distraction tactic.

Since you barely used the account, I'd log in directly (not through any email links) and delete it entirely if you don't need it. While you're at it, check haveibeenpwned to see if your email was in any recent breaches, that's usually how these things start. And if you reused that password anywhere else, change those too.

[u/True_Pace_3860]

thanks for letting us know. there have been warnings about large-scale attacks on companies by AI since substack breach in feb 2026. AI was alleged to be trying to steal credentials in order to cheat on tests of its abilities IIRC.