SplitVPN Data Breach: How a "No-Logs" VPN Quietly Kept 58 Million Logs on 865,000 Users
Picture this: you're a journalist in Myanmar, an activist in Iran, or just someone in Russia trying to read a news site your government has blocked. You pay for a VPN that promises, in bold letters on its homepage, "No logs or history. 100% privacy guaranteed." You trust that promise with your safety, sometimes literally.
Then, one July morning, a threat actor uploads a 17 GB SQL database to a cybercrime forum and claims it's your VPN provider's entire backend. Inside it: your email, your IP address, your device fingerprint, your masked card details — and a table quietly logging exactly which server your device connected to, and at what timestamp, for the last thirteen months.
That's not a hypothetical. That's what just happened to SplitVPN, the Russian VPN service formerly known as NotVPN. And it's a case study every security team, and every privacy-conscious user, needs to sit with for a minute.
Table of Contents
- What Happened: The SplitVPN Breach Timeline
- What's Actually Inside the Leaked Database
- The "No-Logs" Promise That Wasn't
- Who's Most at Risk
- How This Kind of Breach Gets Detected
- How to Check If You're Affected
- Prevention: What Users and VPN Providers Should Do Differently
- Expert Tips for Evaluating Any VPN's Privacy Claims
- FAQ
- Final Thoughts
What Happened: The SplitVPN Breach Timeline
In July 2026, SplitVPN — rebranded from NotVPN — suffered a breach that exposed a massive slice of its user base. Have I Been Pwned added the incident to its database on August 1, 2026, dating the actual breach event to July 21, 2026, and confirming 865,336 unique compromised accounts.
The source of the leak was a 17 GB SQL dump distributed on the notorious Altenen cybercrime forum, with the seller claiming it was pulled directly from SplitVPN's own infrastructure. Independent researchers from Mysterium obtained and analyzed the dump rather than taking the seller's word for it, and their findings matched the claims closely enough to treat this as credible, not just forum bravado.
Here's the breakdown of what Mysterium's analysis found inside that database:
- ~23.4 million user records
- ~13.6 million device records
- ~2.6 million payment records
- ~58 million VPN connection logs
That last number is the one that should stop you in your tracks, and we'll get to why in a moment.
What's Actually Inside the Leaked Database
Beyond the headline 865K email figure, the exposed dataset reportedly includes a wider set of fields:
- Email addresses and IP addresses
- Country of residence / approximate geolocation
- Partial payment card data (BIN — first six digits — plus last four digits and expiry date)
- Device identifiers and subscription status
- Recurring billing tokens
- Server-to-device connection logs with timestamps
The good news, if there is any, is that full 16-digit card numbers were not exposed — the payment data was masked down to the BIN and last four digits, which limits direct financial fraud risk. This is a meaningful distinction that separates this breach from a "your card is now cloned" scenario, and it's worth giving SplitVPN credit for at least tokenizing payment data properly, even while everything else went wrong.
The "No-Logs" Promise That Wasn't
This is the part that turns a routine breach story into an industry-wide trust problem. Under its earlier NotVPN branding, the service explicitly marketed a "No logs or history" policy with a "100% privacy guaranteed" claim — the exact language VPN providers use to justify charging a premium over free alternatives.
Yet the leaked database reportedly contained a connection-log table tracking device-to-server activity, spanning from June 2025 through July 21, 2026 — the very day the breach dump is dated. That's not a stale backup or an old misconfigured table someone forgot to delete. The continuous, unbroken timestamps suggest this logging was live and actively being written right up until the breach occurred.
To be precise about what these logs do not contain: they don't appear to record browsing destinations or the actual websites users visited. This is connection metadata, not full browsing history. But metadata is exactly what a "we never store your connection logs" promise is supposed to prevent from existing in the first place. Knowing that Device X connected to Server Y at 3:47 PM on a specific date is often more than enough to deanonymize someone, especially when cross-referenced with other data sources.
Who's Most at Risk
The affected user base is reportedly concentrated in Russia, Iran, India, and Myanmar — regions where VPN usage frequently isn't about streaming geo-blocked shows. It's about getting around state-level internet censorship and surveillance.
This is what elevates the SplitVPN incident from "annoying privacy leak" to "potential safety issue." In a market where a VPN is marketed as a shopping convenience, a breach like this means embarrassment and phishing risk. In a market where a VPN is a tool for evading government monitoring, the same connection-log leak can expose exactly the people the tool was supposed to protect — journalists, dissidents, and ordinary citizens circumventing state firewalls.
How This Kind of Breach Gets Detected
For SOC teams and threat intel analysts, the SplitVPN case is a useful reminder of how these incidents typically surface, and it rarely starts with the company's own disclosure:
- Forum monitoring: The dump first appeared on Altenen, a well-known cybercrime marketplace. Dark web and forum monitoring tools are often the earliest tripwire for this kind of leak, well before any official statement.
- Third-party verification: Rather than amplifying an unverified claim, Mysterium's researchers pulled the raw dump and cross-checked record counts against the seller's description. This verification step is what separates a credible breach report from forum noise, and it's a step every analyst should insist on before reporting a "breach" as fact.
- Breach aggregation services: Have I Been Pwned ingesting the dataset and assigning a confirmed count (865,336) is what turns "a forum post claims X" into "a searchable, actionable breach record" for the wider public.
If you're building or maintaining threat intel workflows, this is a solid template: monitor cybercrime forums for database listings → obtain and independently verify samples → cross-reference against known breach aggregators → only then treat the incident as confirmed.
How to Check If You're Affected
If you have ever used NotVPN or SplitVPN, the safest assumption is that your associated email address and IP address should be treated as compromised. Here's how to confirm your exposure:
1. Go to https://haveibeenpwned.com
2. Enter the email address you used to sign up for NotVPN/SplitVPN
3. Look for "SplitVPN" in the list of breaches returned
What it does: Have I Been Pwned checks your email against its aggregated breach database, including the SplitVPN dataset.
When to use it: Immediately, especially if you've ever registered for a VPN service under Russian, Iranian, or similarly censorship-focused branding.
Expected output: A confirmation of which breaches your email appears in, including the date the breach occurred and what data types were exposed.
Prevention: What Users and VPN Providers Should Do Differently
If you're an affected user:
- Change any password reused across the email tied to your VPN account, starting with financial and email accounts.
- Enable two-factor authentication everywhere it's available, prioritizing email and banking.
- Monitor payment statements for unfamiliar charges, even though full card numbers weren't exposed — masked data plus social engineering can still enable fraud.
- Treat any email referencing your VPN usage with suspicion. Leaked account data gives attackers everything they need to craft a convincing, targeted phishing message.
- If you're in a high-censorship region, consider that connection metadata now exists outside the provider's control, and factor that into your personal threat model going forward.
If you're evaluating or operating a VPN service:
- "No-logs" claims mean nothing without independent, published audits. Several major VPN providers have subjected their no-log infrastructure to third-party audits — that's the bar to look for before trusting marketing language.
- Connection logs should have a hard, enforced retention limit (or none at all) baked into the database schema itself, not just a written policy that engineering can quietly ignore.
- Payment tokenization done right (as SplitVPN did with its card data) should be the baseline, not the exception, across every field in the database — not just payments.
Expert Tips for Evaluating Any VPN's Privacy Claims
- Don't trust the homepage — trust the audit report. "No logs" is marketing copy until a named, independent auditor has verified it and published findings.
- Check who owns the company. Jurisdiction and past rebrands (like NotVPN → SplitVPN) are red flags worth researching before you hand over payment details.
- Assume metadata is data. Even providers that genuinely don't log browsing history may still log connection timestamps and server assignments — ask specifically about this, not just "do you log browsing."
- Free and heavily discounted VPNs deserve extra scrutiny. Infrastructure, bandwidth, and support cost money; if you're not paying for it directly, look closely at how the business actually makes money.
Related Cybersecurity Topics You Should Explore
- Brinks Home Data Breach: The Phone Call That Cost Millions
- GPG Command Tutorial: The Encryption Trick Real SOC Analysts Use
- AI Found a Chrome Bug Hiding for 13 Years. Here's How.
- This Open-Source AI Agent Turns ChatGPT Into a Hacker
- GenieLocker Ransomware Explained: How Toy Ghouls Hack ESXi Servers
- ln Command Explained: How Hackers Abuse Symlinks to Hack Root
- NVIDIA BlueField Flaw Lets Hackers Hijack Cloud Servers
- NGINX Buffer Overflow (CVE-2026-42533): Patch Before It's Exploited
- Windows 11 Finally Fixes Its Slowest File Deletion Problem
- Microsoft Just Killed the Fake KMS Server Trick for Good
- GitLab RCE Bug: How a Simple Notebook Diff Gave Attackers Root
FAQ
Q: Was SplitVPN previously known by another name?
A: Yes. SplitVPN is the rebranded version of a service formerly called NotVPN.
Q: How many users were affected by the SplitVPN breach?
A: Have I Been Pwned confirmed 865,336 unique compromised email addresses, though the broader leaked database reportedly contains around 23.4 million user records overall.
Q: Were full credit card numbers exposed?
A: No. Payment data was masked, limited to the first six digits (BIN) and last four digits, plus the expiry date.
Q: Did the breach expose which websites users visited?
A: No. The leaked connection logs reportedly record device-to-server connections and timestamps, not browsing destinations or visited URLs.
Q: Why is this breach considered worse than a typical VPN leak?
A: Because SplitVPN (as NotVPN) explicitly advertised a strict no-logs policy, and the leaked data directly contradicts that claim by showing active, ongoing connection logging.
Q: Who is most at risk from this leak?
A: Users in Russia, Iran, India, and Myanmar, where VPN usage is often tied to bypassing government censorship rather than general privacy preference.
Q: What should I do if I used NotVPN or SplitVPN?
A: Check your email on Have I Been Pwned, change any reused passwords, enable two-factor authentication, and watch closely for VPN-themed phishing attempts.
Final Thoughts
The SplitVPN breach isn't just another entry in the ever-growing list of leaked databases — it's a live demonstration of why "trust me" has never been a security control. A provider can put "100% privacy guaranteed" in its hero banner and still be quietly writing 58 million connection records to a table nobody outside the company ever sees, until a threat actor does the disclosure for them.
If there's one takeaway to carry forward, it's this: privacy claims are only as good as the audit trail behind them. Whether you're choosing a VPN for personal use or evaluating vendors for your organization, ask for the audit, not the tagline.
Have you checked whether your email shows up in the SplitVPN breach yet? Drop a comment with what you found, and share this article with anyone you know who still relies on NotVPN or SplitVPN — in some parts of the world, that share could genuinely help keep someone safer online.