Threat reportData BreachTL-2026-1823
SplitVPN (formerly NotVPN) "No-Logs" VPN Breach Exposes 58 Million Connection Logs, 23.4M User Records
SplitVPN (formerly NotVPN) "No-Logs" VPN Breach Exposes 58 (TL-2026-1823), also tracked as NotVPN Breach, is a high-severity data breach, first published 2026-08-02. It has no confirmed attribution, affects SplitVPN Technologies SplitVPN (formerly NotVPN) VPN mobile/desktop, maps to 14 MITRE ATT&CK techniques (T1005, T1078, T1087), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-1823
- Threat ID
- TL-2026-1823
- Also known as
- NotVPN Breach, SplitVPN Data Leak, SplitVPN deviceProxy Leak
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, telecoms, civil society, news - media
- Target regions
- russia, iran, india, myanmar
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in SplitVPN (formerly NotVPN) "No-Logs" VPN Breach Exposes 58
Malware and tooling: WireGuard
How SplitVPN (formerly NotVPN) "No-Logs" VPN Breach Exposes 58 works
A threat actor using the handle "vhacker51" listed a 17 GB SQL database (compressed ~5 GB) allegedly stolen from SplitVPN, a Russian VPN service formerly branded NotVPN, on the Altenen cybercrime forum on July 21, 2026. Independently verified by Mysterium Network's research team, the dump contains roughly 23.4 million user records, 13.6 million device records, 2.6 million Tinkoff payment records, and nearly 58 million device-to-server connection logs (June 2025-July 21, 2026) that directly contradict SplitVPN's "no logs or history" marketing claim; Have I Been Pwned added the breach on August 1, 2026, confirming 865,336 unique affected email addresses.
SplitVPN, a Russian VPN service marketed for bypassing internet censorship and rebranded from its earlier NotVPN identity (Android package names com.notvpn and com.notvpn2 still reference the legacy brand), advertises a strict "No logs or history: We never store your activity or connection logs" policy. On July 21, 2026, a forum actor operating under the handle "vhacker51" began distributing a 17 GB SQL database (approximately 5 GB compressed, with a public download link) on the Altenen cybercrime/carding forum, claiming the data was stolen directly from SplitVPN's backend infrastructure.
The listing advertised roughly 23.4 million user records, 13.6 million device records, 23.9 million authorization records, 2.6 million Tinkoff payment records, and nearly 58 million device-to-server connection log entries. Security researchers at Mysterium Network obtained a copy of the dump and verified it against the raw data, confirming the counts. The exposed dataset spans email addresses, last-seen IP addresses, countries of residence, approximate geographic locations, device identifiers/hardware IDs, subscription status, recurring-billing tokens issued via the Tinkoff payment gateway, masked card data (BIN plus last four digits and expiry date, not full PANs), transaction amounts and timestamps, authentication tokens, proxy targets, WireGuard peer data, linked Telegram account identifiers, linked Apple ID identifiers, server metrics, internal back-office/App Store provisioning infrastructure tables, and administrator records.
The most damaging element is the `deviceProxy` table: nearly 58 million rows recording which device connected to which VPN server and exactly when, with timestamps running from June 2025 through July 21, 2026 (the apparent breach cutoff date). This table does not record destination websites visited, but device-to-server connection metadata at this granularity is precisely the category of record SplitVPN's marketing promised never to retain, and it is sufficient to support timing-correlation and de-anonymization analysis against a censorship-circumvention user base concentrated in Russia, Iran, India, and Myanmar -- jurisdictions where VPN use itself can carry legal or personal-safety risk.
The `admin` table exposed five named operator accounts (pavel, valerii, maria, andrei, vladislav) with bcrypt password hashes, assigned roles, and action logs; these accounts were created between January and June 2026, suggesting relatively recent administrative infrastructure. Have I Been Pwned ingested the breach on August 1, 2026 and confirmed 865,336 unique email addresses in its consumer-facing notification dataset -- a smaller figure than the seller's full 23.4 million user-record claim, consistent with HIBP typically indexing only the unique-email subset of a larger raw dump. As of the initial reporting, SplitVPN had not publicly confirmed the incident.
MITRE ATT&CK techniques used in TL-2026-1823
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Initial Access
Discovery
Credential Access
T1110 Brute Force; T1552 Unsecured Credentials
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1585 Establish Accounts; T1586 Compromise Accounts; T1588 Obtain Capabilities
Reconnaissance
T1589 Gather Victim Identity Information; T1590 Gather Victim Network Information; T1591 Gather Victim Org Information
Impact
Affected products and versions in SplitVPN (formerly NotVPN) "No-Logs" VPN Breach Exposes 58
- SplitVPN Technologies — SplitVPN (formerly NotVPN) VPN mobile/desktop applications and backend infrastructure
Vulnerable versions: All accounts and devices registered or connected prior to 2026-07-21
Remediation for SplitVPN (formerly NotVPN) "No-Logs" VPN Breach Exposes 58
Immediate actions
- Rotate/revoke Tinkoff recurring-payment tokens tied to SplitVPN subscriber accounts and monitor cardholders for unauthorized charges using the exposed BIN + last-four + expiry data
- Force password reset and bcrypt-hash invalidation for the five exposed SplitVPN admin/operator accounts (pavel, valerii, maria, andrei, vladislav), and for any external accounts where those operators reused the same credentials
- Notify affected users -- especially those in Russia, Iran, India, and Myanmar -- that device-to-server connection timestamps (June 2025-July 21 2026) were exposed and may enable timing-correlation/de-anonymization, and advise heightened OPSEC
- Monitor Altenen and adjacent carding/breach forums for redistribution or re-sale of the dump and pursue takedown of the public download link
Workarounds
- Treat SplitVPN's privacy guarantee as broken for the June 2025-July 2026 window; users with heightened threat models should migrate to a provider with a completed independent no-logs audit
- Where SplitVPN supports one-time payment methods, move off stored recurring-billing tokens to limit exposure from any future backend compromise
Longer-term hardening
- Adopt cryptographic log minimization (ephemeral in-memory connection state, no persistent per-connection timestamp table) so 'no-logs' claims are structurally true and independently auditable
- Commission and publish an independent third-party no-logs audit, as competing VPN providers have done after similar incidents
- Segment and encrypt-at-rest payment-token and admin-credential tables separately from bulk user/connection data behind stricter, logged access controls
- Deploy database-access anomaly detection and canary records on backend SQL infrastructure to catch bulk exfiltration earlier
Weaknesses (CWE) in SplitVPN (formerly NotVPN) "No-Logs" VPN Breach Exposes 58
Timeline of SplitVPN (formerly NotVPN) "No-Logs" VPN Breach Exposes 58
- Earliest timestamps in the leaked deviceProxy connection-log table begin (~June 2025), showing SplitVPN was retaining device-to-server connection records at least 13 months before the breach, despite its 'no logs or history' marketing claim.
- First of five exposed SplitVPN administrator accounts (pavel, valerii, maria, andrei, vladislav) begin being created in the admin table (January-June 2026 window).
- Final administrator accounts in the exposed admin table are created, closing out the January-June 2026 account-creation window later found in the leaked dump.
- Threat actor 'vhacker51' posts a listing on the Altenen cybercrime forum advertising the 17 GB (compressed ~5 GB) SplitVPN SQL database dump with a public download link.
- Connection-log entries in the leaked deviceProxy table stop, marking the apparent date SplitVPN's backend database was accessed/exfiltrated.
- Security Affairs and Bitdefender HotForSecurity publish the first public reporting on the breach; coverage notes Mysterium Network's research team obtained and verified the dump against the raw data.
- Have I Been Pwned ingests the SplitVPN breach, confirming 865,336 unique affected email addresses in its public notification dataset.
- DataBreaches.net publishes a detailed analysis highlighting the contradiction between SplitVPN's advertised no-logs policy and the ~58 million retained connection-log entries; SplitVPN has not publicly confirmed the incident as of this date.
Sources cited for SplitVPN (formerly NotVPN) "No-Logs" VPN Breach Exposes 58
- A 'no-logs' VPN that kept 58 million connection logs: inside the NotVPN/SplitVPN breach
- VPN Breach Exposes 58 Million Connection Logs Despite "No-Logs" Claims
- SplitVPN breach reveals 58 million hidden connection logs
- SplitVPN 'no logs' claim contradicted by massive data leak
- SplitVPN Data Breach Exposes 865k Users' Personal Records
- Have I Been Pwned: SplitVPN Data Breach
- SplitVPN - 865,336 breached accounts
- Dark Web Informer: SplitVPN user, device, and connection logs allegedly leaked
- Questa VPN prometteva massima sicurezza ma conservava 58 milioni di log ora sul dark web
- SplitVPN unlimited fast VPN - App Store
- SplitVPN - Secure VPN Proxy - Google Play
- NotVPN - Unlimited VPN - Google Play
Detection coverage for TL-2026-1823
As of 2026-08-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1823 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.