No-logs VPN breach exposes 58 million connection logs it promised not to keep

A breach at SplitVPN, a service formerly called NotVPN that marketed itself as keeping no logs, exposed a 17GB database containing roughly 58 million connection logs. The logs record which device connected to which server and when, running continuously up to the day of the breach, directly contradicting the no-logs promise. Cross-referenced with user and device tables holding emails, last-seen IP addresses, and hardware identifiers, they can reconstruct who connected from where and when for tens of millions of people. The data also includes about 23 million user records and 2.6 million payment records with masked card details. Operator account hashes were exposed too.

Check

SplitVPN or NotVPN users should assume their connection history and account details are exposed, change reused passwords, and watch for phishing and extortion referencing their VPN use.

Affected

Tens of millions of SplitVPN users whose connection logs, emails, IP addresses, device identifiers, and masked payment details were exposed, despite the service's advertised no-logs policy, enabling activity reconstruction and targeted fraud.

Fix

Treat no-logs claims as unverifiable marketing rather than a guarantee, prefer providers with independent audits or verifiable architectures, and where anonymity matters, avoid a single centralized intermediary that decides what to log.