🚨 A "No-Logs" VPN Was Secretly Logging 58 Million Connections — A Breach Breakdown for Devs & SOC Teams
SplitVPN (formerly NotVPN) suffered a major data breach in July 2026, exposing 865,336 user accounts. The technical details here are worth a closer look, especially if you work anywhere near auth systems, logging infrastructure, or security architecture.
The leaked 17 GB SQL database, verified by researchers at Mysterium, contained:
- 23.4 million user records
- 13.6 million device records
- 2.6 million payment records
- 58 million VPN connection logs
Here's the part that should make every engineer pause: the service explicitly marketed a "No logs or history" policy. Yet the database included a live connection-log table tracking device-to-server activity continuously from June 2025 through the breach date — meaning the schema itself contradicted the privacy policy from day one.
Payment data was properly tokenized (masked BIN + last 4 digits only) — a good implementation detail worth noting. But connection metadata (device ID, server, timestamp) was retained indefinitely with no apparent enforcement layer.
This is a solid real-world case study in:
🔹 Why "policy vs. schema" mismatches are a recurring root cause in breach incidents
🔹 How breach detection actually works (forum monitoring → third-party verification → breach aggregation via HIBP)
🔹 Why data retention limits need to be enforced at the database layer, not just written in a privacy policy PDF
I break down the full technical timeline, the SOC/threat-intel detection workflow, and practical takeaways for anyone building or auditing systems that make privacy promises:
🔗 https://www.xpert4cyber.com/2026/08/splitvpn-data-breach-865k-users-exposed.html
Top comments (0)