# SplitVPN (formerly NotVPN) Breach Exposes 58M Connection Logs, 23.4M User Records Despite 'No Logs' Claims

> Russian VPN provider SplitVPN (rebranded from NotVPN) suffered a breach exposing a 17GB SQL database with 23.4M user records, 13.6M device records, 2.6M Tinkoff payment records, and 58M device-to-server connection logs spanning June 2025-July 2026, directly contradicting its marketed 'no logs or history' claim. Mysterium's research team verified the dump against a copy circulating on the Altenen cybercrime forum, which also exposed five bcrypt-hashed operator admin accounts.

- **Published:** 2026-07-29T00:00:00Z
- **Last reviewed:** 2026-07-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1815
- **ID:** TL-2026-1815
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SplitVPN, a Russian VPN provider rebranded from NotVPN and marketed for bypassing internet censorship, suffered a breach of its backend SQL database. A forum actor using the handle 'vhacker51' advertised and distributed the archive -- allegedly exfiltrated on July 21, 2026 -- on the Altenen cybercrime forum as a ~5GB compressed (17GB raw) SQL dump with a public download link, listing approximately 23.4 million user records, 13.6 million device records, 23.9 million authorization records, 2.6 million Tinkoff payment records, and roughly 58 million proxy/device connection log entries. Mysterium's research team obtained a copy of the dump and verified the record counts against the raw database, confirming the seller's claims were substantially accurate, with one notable discrepancy: vhacker51 claimed six exposed admin accounts, while Mysterium's investigators confirmed only five.

The most consequential finding is a table (referred to in reporting as 'deviceProxy') recording exactly which device connected to which VPN server and precisely when -- nearly 58 million such entries spanning June 2025 through July 21, 2026, the apparent breach date. This directly contradicts SplitVPN's advertised claim: 'We never store your activity or connection logs. 100% privacy guaranteed.' While the exposed logs do not include full browsing destinations or complete payment card numbers, they are sufficient to reconstruct which user, from which IP address and device, connected to which server and at what time -- effectively de-anonymizing VPN sessions the service promised never to record.

Beyond the 'deviceProxy' connection-log table, the dump comprised at least a 'users' table (account emails, most-recent IP addresses, country/geolocation, subscription status), a 'device' table (hardware identifiers, device fingerprints, and operating-system values), an 'authorization' table (~23.9 million session/authorization-token records), and an 'admin' table exposing named operator accounts. Exposed fields also included recurring billing tokens and masked card data (BIN + last four digits, expiry, authorization codes for recurring charges) tied to the Tinkoff payment gateway, authentication tokens, WireGuard peer configurations, Telegram account linkages, Apple ID references, server metrics, and internal infrastructure details including App Store account-provisioning data. The 'admin' table exposed five named SplitVPN operator/admin accounts (pavel, valerii, maria, andrei, vladislav) with bcrypt-hashed passwords, assigned roles, and a complete admin action log; account creation timestamps for these five accounts run from January through June 2026.

No public reporting identifies the specific technical vulnerability or misconfiguration (e.g., exposed database, compromised credentials, insider access) that led to the initial exfiltration -- the incident is documented purely as a leaked/stolen database now circulating for free download on a cybercrime forum, with no CVE assigned and no vendor confirmation. The exposure is disproportionately dangerous for SplitVPN's core user base, concentrated in Russia, Iran, India, and Myanmar, where VPN usage is frequently used to evade state censorship and where connection metadata linking a real identity, device, and timestamp to VPN usage could expose activists, journalists, or ordinary citizens to state surveillance or persecution. Have I Been Pwned added the breach on August 1, 2026, loading 865,300 unique compromised email addresses for public search and notification. As of this writing, SplitVPN has issued no public confirmation or remediation statement.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1590 Gather Victim Network Information
- T1596 Search Open Technical Databases
- T1650 Acquire Access
- T1586 Compromise Accounts
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1078 Valid Accounts
- T1566 Phishing
- T1087 Account Discovery
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- T1592 Gather Victim Host Information
- T1597 Search Closed Sources
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1069 Permission Groups Discovery

## Sources

- [VPN breach exposes 58 million connection logs despite 'no logs' claims](https://securityaffairs.com/196197/security/vpn-breach-exposes-58-million-connection-logs-despite-no-logs-claims.html)
- [SplitVPN 'no logs' claim contradicted by massive data leak](https://www.scworld.com/brief/splitvpn-no-logs-claim-contradicted-by-massive-data-leak)
- [SplitVPN breach reveals 58 million hidden connection logs](https://www.bitdefender.com/en-us/blog/hotforsecurity/splitvpn-breach-58-million-connection-logs)
- [Have I Been Pwned: SplitVPN Data Breach](https://haveibeenpwned.com/Breach/SplitVPN)
- [SplitVPN - 865,336 breached accounts](https://www.redpacketsecurity.com/splitvpn-865-336-breached-accounts/)
- [Dark Web Informer: SplitVPN user, device, and connection logs allegedly leaked](https://x.com/DarkWebInformer/status/2079984367514923337)
- [Daily Drop (1342)](https://bragg.substack.com/p/daily-drop-1342)
- [NotVPN - Unlimited VPN (Google Play)](https://play.google.com/store/apps/details?id=com.notvpn)
- [SplitVPN - Secure VPN Proxy (Google Play)](https://play.google.com/store/apps/details?id=com.notvpn2)
- [SplitVPN unlimited fast VPN (App Store)](https://apps.apple.com/us/app/splitvpn-unlimited-fast-vpn/id6755629713)
- [NotVPN - unlimited VPN (App Store)](https://apps.apple.com/us/app/notvpn-unlimited-vpn/id6502842838)
- [A no-logs VPN operator kept 58 million connection logs (Mysterium)](https://www.facebook.com/mysteriumvpn/posts/a-no-logs-vpn-operator-kept-58-million-connection-logs-notvpn-a-service-marketed/1004082689294302/)
- [VPN violata, in vendita 58 milioni di log degli utenti](https://www.punto-informatico.it/vpn-violata-vendita-58-milioni-log-utenti/)
- [Questa VPN prometteva massima sicurezza ma conservava 58 milioni di log ora sul dark web](https://tech.everyeye.it/notizie/vpn-prometteva-massima-sicurezza-conservava-58-milioni-log-dark-web-893410.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1815