On February 3, 2026, Substack disclosed that a third party had gained access to user email addresses, phone numbers, and internal metadata during an October 2025 breach. The company fixed the vulnerability, promised an investigation, and moved on. The internet, predictably, did not. A wave of blog posts and Hacker News threads followed, the loudest of them urging writers to abandon the platform’s built-in audience for the safety of a personal website. The advice is well-meaning and almost entirely beside the point.
The breach wasn’t a security story. It was an ownership story, one that a custom domain and a Mailchimp account won’t solve. What the exposed metadata actually revealed is that Substack is not infrastructure. It’s a media company that has spent five years convincing writers it’s a utility, and the writers who bought that pitch are now discovering they’re not customers — they’re tenants.
The Algorithm Doesn’t Just Discover — It Decides
If the breach cracked the illusion, the events of April 2026 shattered it. Substack’s discovery algorithm, the feed that surfaces new writers to readers browsing the platform, suddenly elevated a controversial figure to the top of its news category. The writer hadn’t changed his output. He’d been publishing on Substack for a year and a half. What changed was that Substack decided to surface him.
This is not how a utility behaves. Con Edison does not decide which appliances get power first. AWS does not promote one startup’s servers over another’s in the EC2 dashboard. But Substack’s algorithm is making editorial judgments — boosting some voices, burying others — under the banner of “discovery.” The company removed five publications in its earlier moderation crackdown, none of which had paid subscribers, while leaving its content guidelines unchanged. That’s not a terms-of-service enforcement. That’s a line-editing decision made at the platform level, and it tells every writer on the service exactly who holds the red pen.
One writer whose email address was exposed in the October breach put it to me this way, in a DM exchange after the February disclosure: “I didn’t realize until that moment that I don’t actually have my subscribers’ emails. Substack has them. I just rent the list.” She’s still on the platform. Most writers are. The audience is too good to leave. That’s the trap, and it’s a perfectly legal one.
Your Website Won’t Save You From the Distribution Problem
The “you need a website” advice is correct about the symptom and wrong about the disease. Yes, a personal site gives you control over your archive, your design, and your email list. It does not give you distribution. The reason 517 people upvoted that Hacker News post is the same reason most of them will never leave Substack: the platform solves the hardest problem in independent publishing, which is getting strangers to read your work. A Squarespace page and a dream do not replicate that.
What the breach actually exposed is a category error that the entire creator economy has been making for a decade. Writers treat Substack like a pipe — a neutral conduit between their work and their readers. Substack treats itself like a magazine that happens to let anyone submit articles. The difference matters. A pipe doesn’t curate. A pipe doesn’t launch a standalone Apple TV app for video content, as Substack did in January 2026. A pipe doesn’t have an editorial line. Substack has all three, and the only question is when — not whether — those editorial instincts will conflict with a writer’s interests.
The Real Lesson: Know Who Holds the Keys
The breach didn’t create the vulnerability. It revealed it. Every Substack writer’s subscriber list, payment relationship, and content archive lives on someone else’s server, governed by someone else’s priorities. The company can change its fee structure, tweak its algorithm, or decide your niche is no longer welcome, and your recourse is the same as any tenant’s: accept the new terms or leave, abandoning the audience you spent years building.
That’s not a scandal. It’s a business model, and a perfectly legitimate one. The New York Times can fire a columnist. YouTube can demonetize a channel. The problem isn’t that Substack has power — it’s that Substack spent years pretending it didn’t, and writers believed it. The breach was just the moment the plumbing became visible.
A personal website is a fine thing to have. But the writers who are rushing to register domains this month are solving the wrong problem. The problem isn’t where your files live. It’s who controls the relationship with your readers, and on what terms. Until writers have an answer to that question that doesn’t begin and end with a Substack login screen, no amount of static-site-generator enthusiasm will make them independent. They’ll just be tenants with nicer furniture.