On 1 August, the breach-notification service Have I Been Pwned added a new entry to its database: SplitVPN, a Russian VPN provider formerly trading as NotVPN. The company's marketing had been unambiguous — “No logs or history: We never store your activity or connection logs.” The leaked database contained roughly 58 million connection log entries.
This is not a story about one bad provider. It is the clearest illustration in years of a problem that affects every privacy service on the market, including ours: a no-logs policy is a promise, and promises are not verifiable from the outside.
What happened
The breach itself dates to 21 July 2026. A threat actor posted a 17 GB SQL database, taken from SplitVPN's infrastructure, on the cybercrime forum Altenen. Researchers at Mysterium obtained a copy and verified its contents. Have I Been Pwned catalogued it on 1 August.
The scale depends on how you count. The dump reportedly holds around 23.4 million user records, 13.6 million device records and 2.6 million payment records — but a single person generates many rows. Deduplicated down to unique email addresses, Have I Been Pwned lists 865,336 affected accounts. That second number is the one that means “people.”
According to the reporting, the exposed fields included:
- Email addresses and IP addresses
- Device identifiers and hardware information
- Approximate location data and country of residence
- Subscription status and recurring billing tokens
- Partial payment card data — the first six and last four digits, plus expiry date
- Administrator credentials, stored as bcrypt hashes
And then the part that matters most: a table named deviceProxy, recording which device connected to which server and precisely when. Almost 58 million rows of it, spanning June 2025 through the day of the breach. More than a year of continuous connection history, held by a company that said it kept none.
Why connection logs are the dangerous part
Most people read a breach headline, see “emails and partial card numbers,” and mentally file it next to every other leak. That instinct is wrong here, and it is worth being precise about why.
A leaked email address tells an attacker you exist. A leaked connection log tells them where you were.
Each row in a table like that is a small fact: this device, this exit server, this timestamp. Individually harmless. Assembled into a year-long series, they become a movement history — when you are typically online, which country you route through, when your habits changed, when you travelled. Correlate the timestamps against any other dataset that carries a clock — a forum post, a login record, a transaction — and the pseudonymity a VPN is supposed to provide starts to come apart.
This is exactly the material a no-logs policy exists to not create. The entire security argument for the model is that data which was never written down cannot be leaked, subpoenaed, sold in a bankruptcy, or taken by whoever compromises the database next. SplitVPN wrote it down anyway.
A no-logs policy is not a feature you can switch on. It is a set of choices about what your infrastructure is physically capable of remembering.
The claim nobody can check
Here is the uncomfortable structural problem. “We keep no logs” is, from a customer's chair, unfalsifiable. You cannot inspect the servers. You cannot read the database schema. Every provider in the market makes some version of the same statement, in roughly the same font, and from the outside they are indistinguishable.
The claim only ever gets tested by accident — when a provider is breached, seized, or subpoenaed, and the records either exist or they do not. Which means that at the moment you are choosing a provider, the marketing copy carries almost no information. It is the one specification you are asked to take entirely on faith.
That is not an argument for cynicism. It is an argument for asking better questions.
What actually distinguishes a real no-logs setup
Some things are more than marketing, because they change what the infrastructure can do rather than what a policy page says it does.
Independent audits
An audit is a third party with access to the actual systems, publishing findings you can read. It is a snapshot, not a guarantee — a provider audited in 2024 could change its architecture in 2025. But an audit report with a firm's name attached is a claim someone can be held to. A policy page is not. Look for the report itself, its date, and who paid for it.
Diskless, RAM-only servers
If a server runs entirely from memory with no persistent disk, then seizing the hardware yields nothing, because a power cycle wipes it. This is a real architectural difference and it is verifiable in the sense that it constrains what is possible, not just what is intended.
How little they need to know about you
Look at what an account actually requires. An email address and a payment method is a small amount of identity. A phone number, a verified name, or a payment path that ties your legal identity to your traffic is a much larger one. Data that was never collected does not appear in a dump.
Jurisdiction, honestly assessed
Jurisdiction determines who can compel a provider to start logging, and whether they are permitted to tell you it happened. This deserves more thought than the marketing-map treatment it usually gets, and the honest version includes a provider's own incentives — ours included.
What they say when it goes wrong
Note what has not happened in this case: as of writing, there is no public statement from SplitVPN. No disclosure, no notification, no account of what was retained or why. The silence is itself information. How a company behaves in the two weeks after a breach tells you considerably more than anything on its homepage.
The honest limit of all of this
We should be straight about something, since a VPN company writing about a VPN breach is exactly the situation where you should expect the writing to be self-serving.
Using a VPN moves your trust. It does not eliminate it. Without one, your internet provider and every network you touch can see which sites you connect to. With one, they cannot — but your VPN provider is now the party in that position. That is a genuinely good trade when the provider is competent and disciplined, because a VPN is a company you chose and can leave, whereas your ISP is usually neither. It is a bad trade when the provider is careless. SplitVPN's users made what they thought was the first kind of trade.
A VPN also cannot fix what a service does with the data you hand it directly. Encryption protects data in transit. If you log into an account, that account knows who you are regardless of which country your traffic appears to come from.
What a VPN is good at is narrow and real: it stops the networks between you and the site from reading or recording your traffic, and it stops the site from seeing your home IP address. On hostile Wi-Fi, under censorship, or against ISP-level tracking, that is the whole game.
If you used SplitVPN
Assume the connection history is public and act accordingly. Check Have I Been Pwned for your address. Change the account password, and change it anywhere you reused it — credential stuffing against other services is the standard next step after a dump like this. Watch the card whose first six and last four digits were exposed; that combination is not enough to charge, but it is enough to make a convincing phishing message. Treat any email referencing your VPN subscription with suspicion for a while.
And then consider the more general lesson. The company in this story was not obscure. It had hundreds of thousands of paying users who read the same sentence about connection logs that you have read on a dozen other sites, and had no way to know it was false. The only thing that would have protected them is a provider that had built its systems so the sentence was true.