Threat reportData BreachTL-2026-1815
SplitVPN (formerly NotVPN) Breach Exposes 58M Connection Logs, 23.4M User Records Despite 'No Logs' Claims
SplitVPN (formerly NotVPN) Breach Exposes 58M Connection (TL-2026-1815), also tracked as SplitVPN/NotVPN Breach, is a high-severity data breach, first published 2026-07-29. It has no confirmed attribution, affects SplitVPN Technologies SplitVPN (formerly NotVPN) mobile VPN, maps to 19 MITRE ATT&CK techniques (T1069, T1078, T1087), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-1815
- Threat ID
- TL-2026-1815
- Also known as
- SplitVPN/NotVPN Breach, SplitVPN No-Logs Leak
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- consumer, civil society, news - media, government administration
- Target regions
- russia, iran, india, myanmar
- Detection rules
- 9
- Indicators of compromise
- 26
How SplitVPN (formerly NotVPN) Breach Exposes 58M Connection works
Russian VPN provider SplitVPN (rebranded from NotVPN) suffered a breach exposing a 17GB SQL database with 23.4M user records, 13.6M device records, 2.6M Tinkoff payment records, and 58M device-to-server connection logs spanning June 2025-July 2026, directly contradicting its marketed 'no logs or history' claim. Mysterium's research team verified the dump against a copy circulating on the Altenen cybercrime forum, which also exposed five bcrypt-hashed operator admin accounts.
SplitVPN, a Russian VPN provider rebranded from NotVPN and marketed for bypassing internet censorship, suffered a breach of its backend SQL database. A forum actor using the handle 'vhacker51' advertised and distributed the archive -- allegedly exfiltrated on July 21, 2026 -- on the Altenen cybercrime forum as a ~5GB compressed (17GB raw) SQL dump with a public download link, listing approximately 23.4 million user records, 13.6 million device records, 23.9 million authorization records, 2.6 million Tinkoff payment records, and roughly 58 million proxy/device connection log entries. Mysterium's research team obtained a copy of the dump and verified the record counts against the raw database, confirming the seller's claims were substantially accurate, with one notable discrepancy: vhacker51 claimed six exposed admin accounts, while Mysterium's investigators confirmed only five.
The most consequential finding is a table (referred to in reporting as 'deviceProxy') recording exactly which device connected to which VPN server and precisely when -- nearly 58 million such entries spanning June 2025 through July 21, 2026, the apparent breach date. This directly contradicts SplitVPN's advertised claim: 'We never store your activity or connection logs. 100% privacy guaranteed.' While the exposed logs do not include full browsing destinations or complete payment card numbers, they are sufficient to reconstruct which user, from which IP address and device, connected to which server and at what time -- effectively de-anonymizing VPN sessions the service promised never to record.
Beyond the 'deviceProxy' connection-log table, the dump comprised at least a 'users' table (account emails, most-recent IP addresses, country/geolocation, subscription status), a 'device' table (hardware identifiers, device fingerprints, and operating-system values), an 'authorization' table (~23.9 million session/authorization-token records), and an 'admin' table exposing named operator accounts. Exposed fields also included recurring billing tokens and masked card data (BIN + last four digits, expiry, authorization codes for recurring charges) tied to the Tinkoff payment gateway, authentication tokens, WireGuard peer configurations, Telegram account linkages, Apple ID references, server metrics, and internal infrastructure details including App Store account-provisioning data. The 'admin' table exposed five named SplitVPN operator/admin accounts (pavel, valerii, maria, andrei, vladislav) with bcrypt-hashed passwords, assigned roles, and a complete admin action log; account creation timestamps for these five accounts run from January through June 2026.
No public reporting identifies the specific technical vulnerability or misconfiguration (e.g., exposed database, compromised credentials, insider access) that led to the initial exfiltration -- the incident is documented purely as a leaked/stolen database now circulating for free download on a cybercrime forum, with no CVE assigned and no vendor confirmation. The exposure is disproportionately dangerous for SplitVPN's core user base, concentrated in Russia, Iran, India, and Myanmar, where VPN usage is frequently used to evade state censorship and where connection metadata linking a real identity, device, and timestamp to VPN usage could expose activists, journalists, or ordinary citizens to state surveillance or persecution. Have I Been Pwned added the breach on August 1, 2026, loading 865,300 unique compromised email addresses for public search and notification. As of this writing, SplitVPN has issued no public confirmation or remediation statement.
MITRE ATT&CK techniques used in TL-2026-1815
Discovery
T1069 Permission Groups Discovery; T1087 Account Discovery
Initial Access
T1078 Valid Accounts; T1566 Phishing
Credential Access
T1110 Brute Force; T1552 Unsecured Credentials
Collection
T1119 Automated Collection; T1213 Data from Information Repositories
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1586 Compromise Accounts; T1650 Acquire Access
Reconnaissance
T1589 Gather Victim Identity Information; T1590 Gather Victim Network Information; T1592 Gather Victim Host Information; T1596 Search Open Technical Databases; T1597 Search Closed Sources
Impact
Affected products and versions in SplitVPN (formerly NotVPN) Breach Exposes 58M Connection
- SplitVPN Technologies — SplitVPN (formerly NotVPN) mobile VPN application and backend database/infrastructure
Vulnerable versions: all SplitVPN/NotVPN accounts and backend records active as of the July 21, 2026 breach date
Fixed in: no patch, fix, or vendor remediation statement reported as of August 2, 2026
Remediation for SplitVPN (formerly NotVPN) Breach Exposes 58M Connection
Immediate actions
- Treat all SplitVPN/NotVPN account email addresses, IP addresses, and device identifiers as compromised
- Reset SplitVPN/NotVPN account passwords, and any other account where the same password was reused
- Enable two-factor authentication on the SplitVPN/NotVPN account and any linked services (Telegram, Apple ID) where supported
- Monitor bank/card statements associated with the Tinkoff recurring billing token for unauthorized charges
- Users in high-censorship regions (Russia, Iran, India, Myanmar) should assume connection metadata linking their identity/device to VPN usage may be exposed and adjust operational security accordingly
- Be alert to phishing attempts referencing SplitVPN/NotVPN account details, billing information, or VPN usage patterns
Workarounds
- Discontinue use of SplitVPN/NotVPN until the vendor confirms the incident and publishes an independently audited no-logs report
- Migrate to an independently audited, no-logs VPN provider for censorship circumvention in high-risk regions
Longer-term hardening
- Do not trust a 'no logs' marketing claim without an independently published no-logs audit -- this incident shows the claim was false in practice
- SOC/detection teams should hunt for phishing and credential-stuffing campaigns leveraging the 865,300+ exposed email addresses and associated device/IP data
- Track re-emergence of this dataset (or derivatives) on cybercrime forums and marketplaces for ongoing exposure monitoring
Timeline of SplitVPN (formerly NotVPN) Breach Exposes 58M Connection
- Earliest connection log entries in the leaked SplitVPN 'deviceProxy' table begin, despite the service's marketed 'no logs or history' policy.
- First of five exposed SplitVPN operator/admin accounts (pavel, valerii, maria, andrei, vladislav) is created, per timestamps recovered from the leaked admin table.
- Final operator admin account created, closing the January-June 2026 admin-account creation window found in the dump.
- Connection-log data in the dump ends and the SplitVPN backend database is reported stolen by the forum actor 'vhacker51'; this date marks the apparent breach/exfiltration cutoff.
- Security Affairs publishes the first mainstream report on the breach, citing Mysterium's research-team verification of the dump against the raw database, which confirmed the seller's counts as substantially accurate but found only 5 exposed admin accounts against the seller's claim of 6.
- Dark Web Informer identifies the forum actor 'vhacker51' on the Altenen cybercrime forum advertising the SplitVPN/NotVPN SQL dump (~5GB compressed, 17GB raw) with a public download link, listing ~23.4M users, 58M proxy connection logs, 23.9M authorization records, 13.6M devices, and 2.6M Tinkoff payment records.
- Bitdefender HotForSecurity and SC Media publish independent coverage confirming Mysterium's record counts and the 'no logs' claim contradiction.
- Have I Been Pwned adds the SplitVPN breach, loading 865,300 unique compromised email addresses for public search and notification.
- SplitVPN has issued no public confirmation, statement, or remediation plan addressing the breach as of this date.
Sources cited for SplitVPN (formerly NotVPN) Breach Exposes 58M Connection
- VPN breach exposes 58 million connection logs despite 'no logs' claims
- SplitVPN 'no logs' claim contradicted by massive data leak
- SplitVPN breach reveals 58 million hidden connection logs
- Have I Been Pwned: SplitVPN Data Breach
- SplitVPN - 865,336 breached accounts
- Dark Web Informer: SplitVPN user, device, and connection logs allegedly leaked
- Daily Drop (1342)
- NotVPN - Unlimited VPN (Google Play)
- SplitVPN - Secure VPN Proxy (Google Play)
- SplitVPN unlimited fast VPN (App Store)
- NotVPN - unlimited VPN (App Store)
- A no-logs VPN operator kept 58 million connection logs (Mysterium)
- VPN violata, in vendita 58 milioni di log degli utenti
- Questa VPN prometteva massima sicurezza ma conservava 58 milioni di log ora sul dark web
Detection coverage for TL-2026-1815
As of 2026-07-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1815 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.