Substack data breach exposed user email addresses and phone numbers for months before CEO Chris Best confirmed the October incident in February, prompting security concerns.