SplitVPN Breach: The “No-Logs” VPN That Logged 58 Million Connections

The “No-Logs” Promise That Wasn’t: SplitVPN’s 58 Million Connection Logs and What It Means for Privacy in 2026

In late July 2026, a 17 GB SQL database quietly appeared on the Altenen cybercrime forum. The seller, operating under the handle vhacker51, claimed it came from SplitVPN (formerly NotVPN), a Russian service marketed heavily to users trying to bypass internet censorship. Researchers at Mysterium VPN obtained a copy, verified the dump against the raw MySQL export, and confirmed the numbers: roughly 23.4 million user records, 13.6 million device profiles, 2.6 million payment records, and nearly 58 million connection logs.

Those connection logs are the part that should stop every VPN user cold.

SplitVPN’s own marketing stated, clearly and repeatedly: “No logs or history: We never store your activity or connection logs. 100% privacy guaranteed.” The deviceProxy table in the stolen database recorded, for years, which device connected to which server and exactly when—Unix timestamps running continuously from June 2025 right up to the day of the breach. No full browsing history or destination URLs appear to have been captured, but the metadata is more than enough to reconstruct who connected, from where, to which node, and on what schedule.

This is not a subtle technical disagreement about what counts as a “log.” It is a direct contradiction between the product’s public promise and its actual architecture.

Why This Breach Hits Differently

Most data breaches expose emails, passwords, or payment tokens. Those are bad enough. A VPN breach that includes connection metadata is different because the entire value proposition of a VPN is the claim that your activity cannot be tied back to you. When that claim collapses, the tool itself becomes evidence.

Users of SplitVPN were concentrated in places where that evidence carries real weight—Russia, Iran, India, Myanmar, and other jurisdictions with aggressive content filtering or political controls. An email address linked to a history of connecting to specific servers at specific times can become a liability in ways that ordinary account credentials are not. The database also contained last-seen IP addresses, approximate locations, device identifiers (including Apple identifierForVendor UUIDs and push tokens), operating system details, subscription status, and recurring-billing tokens from the Tinkoff payment gateway. Full card numbers were masked, but the combination of identifiers is still highly useful for targeted phishing, account takeover attempts, or worse.

The existence of the logs also reveals something structural. Nothing in the system design prevented those rows from being written. The company could have run a true no-logs architecture (RAM-only servers, ephemeral session data that is never persisted, no central connection table). Instead it maintained a production database that quietly accumulated tens of millions of records. “No-logs” was a sentence in a privacy policy, not a property of the software.

The Trust Problem the Industry Still Hasn’t Fixed

This is not the first time a “no-logs” VPN has been caught keeping records or handing them over. The pattern is familiar: strong marketing language, limited independent verification, and then a breach or a legal request that reveals the gap. Users are left sorting through affiliate-driven review sites that rarely emphasize architecture or audit history over speed tests and coupon codes.

A genuine no-logs posture requires more than a policy page. It requires design decisions that make logging difficult or impossible by default, independent audits that examine both the code and the live infrastructure, transparent reporting of legal demands, and a jurisdiction that does not compel data retention. RAM-only servers help because data disappears on reboot. Open-source clients allow outside inspection. Regular third-party audits (with published reports) force the company to prove the claim rather than merely assert it. Transparency reports that show how many requests were received and how many were answered with usable data give users a concrete signal.

Most consumer VPNs still ask users to take the marketing at face value. The SplitVPN incident is a reminder that this is a weak control. Trust claims fail silently until they fail loudly.

What Users Should Actually Look For

If you rely on a VPN for privacy, censorship circumvention, or simply to keep your ISP from building a detailed profile of your habits, treat marketing language as the starting point, not the finish line.

Ask:

Has the provider published recent independent audits that specifically examine logging practices and server configuration?
Are the servers RAM-only, or is there persistent storage that could hold connection metadata?
Does the company publish a transparency report, and what does it show about past legal requests?
Where is the company based, and what are the data-retention laws in that jurisdiction?
Has the provider ever been forced to hand over user data, and how did it respond?
Is the client software open-source or at least independently reviewed?

None of these questions guarantees perfection. They do separate providers that treat privacy as an engineering constraint from those that treat it as a slogan.

The breach also underscores a broader shift visible in 2026. Enterprise environments are moving toward Zero Trust Network Access models that grant per-application access rather than full-network tunnels. Consumer users do not have the same options, so the quality of the VPN they choose still matters. At the same time, age-verification laws, content-blocking systems, and regional internet controls continue to drive demand spikes. When people reach for a VPN under pressure, they are more likely to grab whatever is free or heavily advertised. That is exactly the moment when weak no-logs claims become most dangerous.

Practical Steps If You Were Affected

If you ever used NotVPN or SplitVPN:

Treat the email address and any associated IP addresses as compromised. Change the password on that email account and enable two-factor authentication immediately. Monitor for phishing that references VPN use or recent connection activity. If you paid through Tinkoff or similar, watch statements for unexpected recurring charges and contact the bank if anything looks off. Assume the connection metadata (timestamps and servers) is now in the hands of whoever bought or downloaded the dump. In high-risk environments, that metadata itself can be sensitive.

Then switch. There is no recovery for the logs that already exist. The only useful response is to stop feeding new data into an untrustworthy system.

The Larger Lesson

A VPN is an intermediary. By design it sits between you and the rest of the internet. That position gives it visibility into traffic patterns that most other services never see. When the intermediary keeps records it promised not to keep, the protection reverses. The tool that was supposed to reduce exposure becomes a new source of it.

The SplitVPN case is useful precisely because the contradiction is so clear. The company said one thing in public and did another in its database. The logs were not an accident of incomplete deletion or a temporary debugging table. They were continuous production data running for more than a year.

Privacy tools only work when the incentives and the architecture line up with the claims. Users who want that alignment need to look past the homepage slogans and examine the evidence that is actually available—audits, server design, transparency reporting, and track record under pressure.

In a year when age-verification mandates, content blocks, and state-level filtering continue to expand, the demand for VPNs is not going away. The quality of the providers people choose will determine whether that demand produces real protection or simply more databases waiting to be dumped.

For reliable options that prioritize verifiable no-logs practices, independent audits, and strong technical design, check the NordVPN links in the sidebar and at the bottom of this page.