Pierluigi Paganini
July 29, 2026
A threat actor on the Altenen cybercrime forum is distributing a 17 GB SQL database claimed to have been stolen from SplitVPN, formerly known as NotVPN, a Russian VPN marketed for bypassing internet censorship. Mysterium’s research team obtained a copy, verified it against the raw dump, and confirmed the numbers: roughly 23.4 million user records, 13.6 million device records, 2.6 million payment records, and 58 million connection logs. A VPN that promised zero logs kept tens of millions of them.
“NotVPN’s own marketing promises “No logs or history: We never store your activity or connection logs. 100% privacy guaranteed.” The database contains a table (deviceProxy) that records which device connected to which server, and exactly when — nearly 58 million times, right up to the day of the breach.” states Mysterium’s research team. “No full credit-card numbers were exposed (card data is masked to BIN + last four). But emails, IP addresses, device identifiers, approximate location, subscription status, and recurring-billing tokens were.”
The timestamps run continuously from June 2025 to July 21, 2026, the day of the dump. These aren’t stale test records. The service was still writing connection logs as it was being breached.
The deviceProxy table structure is simple: which device, which server, what time. That’s a connection log. Cross-referenced with the users table, which holds account emails and last-seen IP addresses, and the device table, which holds hardware identifiers, those 58 million rows are enough to reconstruct who connected, from where, to which server, and when, for tens of millions of people.
“A VPN’s single most important promise is that it doesn’t keep the records that would let anyone reconstruct your activity. NotVPN kept them by the tens of millions.” continues the report.
To be precise: the logs record server connections, not destination websites visited. This is metadata, not full browsing history. But metadata is exactly what “we never store your connection logs” promises not to keep.
The seller lists the user base as concentrated in Russia, Iran, India, and Myanmar. That’s not an arbitrary demographic detail.
“The seller lists the user base as concentrated in Russia, Iran, India, and Myanmar. Look at that list again. These are places where people reach for a VPN specifically to get around state censorship: to read independent news, to use blocked messaging apps, to speak freely. For those users, a leaked email-plus-IP-plus-timestamp record isn’t an abstract privacy nuisance.” continues the report. “It’s a document that ties a real person to the act of evading state controls, sitting in a file now circulating on a criminal forum.”
The payment records include masked card numbers, expiry dates, and recurring billing tokens from the Tinkoff payment gateway. Full card numbers aren’t present, but the linkage between a person’s email, their payment history, and a recurring billing token is enough to cause problems.
The admin table exposes five operator accounts, pavel, valerii, maria, andrei, vladislav, with bcrypt password hashes, roles, and a complete admin action log. Account creation dates run from January to June 2026. The database also contains tables pointing to back-office infrastructure for provisioning App Store accounts, which is the plumbing behind distributing a VPN that Russia has been actively removing from app stores.
Mysterium frames the structural lesson clearly: a conventional VPN is a centralized intermediary where the provider, not the user, decides what gets logged. “No-logs” is an unauditable marketing claim backed by nothing the user can verify. When the provider logs anyway, for billing, anti-fraud, capacity planning, or less benign reasons, the user has no way to know until a 17 GB file with their email shows up on a forum. If you used NotVPN or SplitVPN, treat the associated email address and IP as compromised, change passwords everywhere that email was reused, enable two-factor authentication, and factor into your threat model that connection metadata records now exist outside the operator’s control.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, data leak)
