A VPN that marketed itself with the phrase ‘100% privacy guaranteed’ was, the whole time, logging tens of millions of user connections. That’s not a minor technical inconsistency. That’s the entire value proposition collapsing.
According to Security Affairs, a threat actor on the Altenen cybercrime forum is distributing a 17 GB SQL database claimed to have been stolen from SplitVPN, formerly known as NotVPN, a Russian VPN marketed for bypassing internet censorship. Mysterium’s research team obtained a copy, verified it against the raw dump, and confirmed the scale: roughly 23.4 million user records, 13.6 million device records, 2.6 million payment records, and 58 million connection logs.
The most damaging table in the database is called deviceProxy. It records which device connected to which server and exactly when. Nearly 58 million entries, logged continuously from June 2025 right up to July 21, 2026, the day of the breach. Cross-reference those rows with the users table, which holds account emails and last-seen IP addresses, and the device table, which holds hardware identifiers, and you have a detailed map of who connected, from where, to which server, and when. That is a connection log. NotVPN’s own marketing explicitly promised never to keep one.
The payment records include masked card numbers, expiry dates, and recurring billing tokens from the Tinkoff payment gateway. Full card numbers are not present, but the combination of a person’s email, payment history, and a recurring billing token is enough to cause real problems. Five admin accounts are also exposed, complete with bcrypt password hashes, roles, and a full action log of operator activity.
The user base, according to the seller, is concentrated in Russia, Iran, India, and Myanmar. That detail matters. These are countries where people use VPNs specifically to evade state censorship, to read independent news, to use blocked apps, to communicate without surveillance. For those users, a leaked email plus IP address plus timestamp record is not an abstract privacy nuisance. It is a document tying a real person to the act of bypassing state controls, and that document is now circulating on a criminal forum.
This breach fits a pattern that privacy advocates have warned about for years. ‘No-logs’ is a marketing claim. It is unauditable. Users have no way to verify it independently. VPN providers log data for billing, anti-fraud, and capacity planning, and sometimes for less obvious reasons, and the user never knows until a database surfaces somewhere it shouldn’t.
If you used NotVPN or SplitVPN, the recommended steps are straightforward:
- Treat the associated email address and any linked IP addresses as compromised
- Change passwords on every account that reused that email
- Enable two-factor authentication wherever possible
- Assume that connection metadata records now exist outside the operator’s control and factor that into your threat model
The broader lesson is structural. A conventional VPN is a centralized intermediary where the provider decides what gets logged, not the user. So long as that’s the architecture, ‘no-logs’ remains a promise with no enforcement mechanism behind it. This breach is a concrete example of what happens when that promise isn’t kept.