Do you reside outside of the EU (and outside anywhere where GDPR equivalents are enforced)? Maybe that would explain it.

Under GDPR, a business has the obligation to inform users if they have been affected by a data breach. That could hypothetically explain why Substack would inform some users (those protected by GDPRish legislation) while keeping it quiet towards the rest of them.