Listen to this Post
Introduction, When a Privacy Tool Becomes the Privacy Risk
Millions of people rely on Virtual Private Networks (VPNs) to protect their identity, bypass censorship, and browse the internet without being tracked. For users living in countries with heavy internet restrictions, a VPN is often more than a convenience, it is a lifeline that enables free access to information and communication.
That is why the latest exposure involving SplitVPN, formerly known as NotVPN, has sent shockwaves across the cybersecurity community. A service that publicly advertised a strict “no-logs” policy has allegedly been caught storing tens of millions of connection records, contradicting one of the most important promises any VPN provider can make.
According to security researchers at Mysterium, a threat actor has published a massive 17 GB SQL database on the Altenen cybercrime forum. After obtaining and validating the leaked data, researchers confirmed that the breach appears to contain millions of real customer records, including sensitive connection metadata, payment information, device identifiers, and administrative data.
The incident raises serious questions about trust, transparency, and whether users should blindly believe “zero-log” marketing claims without independent audits.
The Database Leak, What Researchers Found
Security researchers examined the leaked SQL database and confirmed that it contains an enormous amount of operational data.
Among the exposed information were:
Approximately 23.4 million user records
Around 13.6 million registered devices
More than 2.6 million payment records
Nearly 58 million VPN connection logs
The scale of the exposure immediately attracted attention because SplitVPN had repeatedly promoted itself as a VPN that never stored user activity or connection history.
Instead, the leaked database appears to show years of continuously collected metadata.
A No-Logs Policy That Apparently Logged Everything
The most controversial finding centers on a database table called deviceProxy.
Researchers say the table records:
Device identifier
VPN server used
Exact connection timestamp
Every single connection generated another record.
By itself, that information may appear harmless.
However, when combined with additional tables containing account emails, IP addresses, hardware identifiers, and subscription details, investigators say it becomes possible to reconstruct a user’s VPN usage history.
This does not reveal which websites someone visited.
Instead, it shows:
Who connected
From which IP address
Using which device
To which VPN server
At what exact time
For a company advertising “we never store connection logs,” that distinction is extremely important.
Connection Metadata Can Be Just as Dangerous
Some people assume metadata is harmless because it does not include browsing history.
Cybersecurity experts strongly disagree.
Metadata can often reveal:
Daily routines
Geographic movement
Device ownership
Work schedules
Online behavior patterns
Identity correlations
Even without recording destination websites, connection metadata alone can become highly valuable for surveillance, intelligence gathering, or criminal investigations.
That is precisely why most reputable privacy-focused VPN providers emphasize that connection logs are never retained.
The Timeline Shows Active Logging Until the Breach
One of the most alarming discoveries involves the timestamps stored inside the leaked database.
Researchers say the records begin in June 2025 and continue uninterrupted until July 21, 2026.
That date reportedly matches the day the database was stolen.
This indicates the VPN service continued recording connection metadata right until the compromise occurred.
These are not old development records or forgotten backups.
They appear to represent active production data.
Millions of Users in High-Risk Countries
The alleged seller of the database claimed the majority of users came from:
Russia
Iran
India
Myanmar
This geographic distribution dramatically increases the seriousness of the incident.
Many citizens in these countries use VPN services specifically to:
Access blocked websites
Read independent journalism
Use encrypted messaging applications
Avoid internet censorship
Communicate safely
For these individuals, leaked connection metadata is not merely a privacy inconvenience.
It could become evidence that they actively bypassed government restrictions.
That dramatically increases the real-world risk for affected users.
Payment Records Also Appear in the Leak
The leaked database reportedly contains approximately 2.6 million payment records.
Researchers say these include:
Masked payment card numbers
Card expiration dates
Subscription status
Billing history
Recurring billing tokens linked to the Tinkoff payment gateway
Although complete payment card numbers were not exposed, recurring payment tokens combined with personal email addresses may still be abused in fraud attempts or targeted phishing campaigns.
Cybercriminals frequently use this type of information to create convincing social engineering attacks.
Administrative Accounts Were Also Exposed
Beyond customer information, researchers also discovered internal administrator data.
The database allegedly contains administrator accounts belonging to several operators.
Exposed information reportedly includes:
Administrator usernames
Role assignments
Bcrypt password hashes
Administrative activity logs
Account creation timelines
Researchers also identified backend infrastructure related to provisioning App Store accounts used to distribute the VPN service.
While bcrypt remains a strong password hashing algorithm, exposed administrator credentials always increase organizational risk if weak passwords were used.
Why Centralized VPNs Create a Trust Problem
This incident illustrates a larger issue affecting many commercial VPN providers.
Users have very limited visibility into what actually happens behind the company’s infrastructure.
Marketing slogans like:
Zero logs
No tracking
Complete anonymity
Total privacy
cannot be independently verified unless an external security audit confirms those claims.
If a provider quietly collects logs for operational purposes, customers often have no way of knowing until an internal database leaks.
Trust alone is not a security model.
Independent verification matters.
What Affected Users Should Do Immediately
Anyone who previously used SplitVPN or NotVPN should assume some account information may now be compromised.
Recommended actions include:
Change passwords associated with the affected email account.
Enable multi-factor authentication (MFA) on every important service.
Monitor payment accounts for suspicious activity.
Watch for phishing emails referencing VPN subscriptions.
Be cautious of unexpected password reset requests.
Review accounts that reused the same credentials elsewhere.
Consider changing email addresses for highly sensitive online accounts if exposure creates elevated personal risk.
For users living in countries with strict internet regulations, additional operational security precautions may also be necessary.
Deep Analysis
The SplitVPN incident demonstrates why technical verification is far more valuable than marketing claims. Security professionals often recommend validating VPN behavior through independent audits, network monitoring, and transparency reports rather than relying solely on promotional statements.
Below are several Linux commands commonly used during incident response and forensic investigations involving database leaks and exposed infrastructure.
Inspect Large SQL Dumps
ls -lh database.sql du -sh database.sql file database.sql
Search for Connection Log Tables
grep -i "deviceProxy" database.sql grep -i "connection" database.sql grep -i "users" database.sql
Extract CREATE TABLE Statements
grep -n "CREATE TABLE" database.sql
Import Database into MySQL
mysql -u root -p leaked_db < database.sql
Count Records
SELECT COUNT() FROM users; SELECT COUNT() FROM deviceProxy; SELECT COUNT() FROM payment;
Identify Recent Records
SELECT MAX(created_at) FROM deviceProxy; SELECT MIN(created_at) FROM deviceProxy;
Review Administrator Accounts
SELECT username, role FROM admin;
Detect Password Hash Types
grep "\$2[aby]\$" database.sql
Search for Email Addresses
grep -E "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+" database.sql
Calculate File Integrity
sha256sum database.sql md5sum database.sql
These commands represent common investigative techniques used by digital forensics analysts when examining leaked datasets in controlled environments.
What Undercode Say
Trust Is the Product
A VPN does not sell bandwidth. It sells trust. Once that trust is broken, the service loses its most valuable asset regardless of its technical performance.
Metadata Is Powerful
Many users underestimate metadata because it excludes browsing history. In reality, metadata often reveals behavioral patterns, locations, and identities that can be equally sensitive.
Marketing Without Verification
The cybersecurity industry has long warned consumers about relying solely on “no-log” marketing statements. Independent third-party audits, transparency reports, and open security practices provide much stronger assurance than advertising slogans.
Centralization Creates Single Points of Failure
A centralized VPN architecture concentrates user information in one place. If that environment is compromised, millions of records can be exposed in a single incident.
Privacy Claims Need Evidence
Modern consumers increasingly expect companies to support privacy claims with external audits, reproducible infrastructure designs, or cryptographic transparency. Unsupported promises are becoming harder to justify.
Operational Data Often Outlives Its Purpose
Organizations frequently retain logs for troubleshooting, billing, or analytics. Without strict retention policies, these datasets can accumulate into high-value targets for attackers.
High-Risk Users Face Greater Consequences
For journalists, activists, researchers, and citizens in heavily censored regions, leaked connection metadata may carry consequences beyond financial fraud, potentially exposing patterns of communication or attempts to access restricted services.
Payment Metadata Can Fuel Social Engineering
Even partially masked payment records can help attackers craft convincing phishing campaigns by referencing legitimate subscription details and billing histories.
Transparency Will Become a Competitive Advantage
VPN providers that publish independent audits, maintain minimal data retention, and openly document their infrastructure are likely to gain greater trust in an increasingly privacy-conscious market.
The Industry Should Learn From This Incident
This breach serves as a reminder that privacy services must continuously align their technical implementation with their public commitments. Any gap between policy and practice can have significant consequences when exposed.
Prediction
(+1) Privacy Verification Will Become the New Industry Standard 🔒
This incident is likely to accelerate demand for independently audited VPN providers and stronger transparency practices. More companies may adopt regular third-party security assessments and publicly verifiable no-log architectures to rebuild consumer confidence. Users are also expected to become more selective, favoring providers that can demonstrate privacy through technical evidence rather than marketing alone.
✅ Verified: Security researchers from Mysterium reported obtaining and validating a leaked 17 GB SQL database allegedly belonging to SplitVPN/NotVPN, containing approximately 23.4 million user records, 13.6 million device records, 2.6 million payment records, and 58 million connection logs.
✅ Verified: The exposed dataset reportedly includes connection metadata, user emails, IP addresses, device identifiers, masked payment details, recurring billing tokens, and administrative information. Researchers state the logs record VPN server connections rather than users’ browsing destinations.
✅ Context Matters: While the findings strongly suggest the VPN retained connection metadata despite advertising a no-logs policy, independent confirmation from SplitVPN regarding the authenticity of the entire leaked dataset and the circumstances surrounding the breach remains essential for a complete assessment.
▶️ Related Video (82% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.linkedin.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
