As reported by SecurityAffairs, a 17 GB SQL database allegedly stolen from SplitVPN — formerly marketed as NotVPN — is being distributed on the Altenen cybercrime forum, containing an estimated 58 million connection logs alongside user, device, and payment records. The provider had marketed itself as a no-logs VPN service, primarily targeting users in regions where internet censorship is prevalent.

Key Takeaway: As reported by SecurityAffairs, a 17 GB SQL database allegedly stolen from SplitVPN — formerly marketed as NotVPN — is being distributed on the Altenen cybercrime forum, containing an estimated 58 million connection logs alongside user, device, and payment records.

Why This Breach Is More Damaging Than a Typical Data Leak

Most data breaches expose credentials or payment details — damaging, but bounded in scope. This incident cuts deeper. Connection logs are uniquely sensitive because they map who connected, when, from where, and potentially to what destination. For users who specifically chose a VPN to evade government surveillance or access censored content — particularly in authoritarian states — this data could carry life-altering consequences. The very population this VPN was marketed to serve may now be the most endangered by its compromise.

"No-logs" is a marketing promise, not a technical guarantee. Without independent audits and transparent infrastructure disclosures, users have no basis to trust the claim.

The Structural Problem with VPN Trust Models

The VPN industry operates on a foundational asymmetry: users must trust providers completely, with little technical ability to verify what is actually being stored. A provider can claim no-logs compliance while maintaining operational logs for debugging, abuse prevention, billing reconciliation, or infrastructure management — all legitimate business reasons that create exactly the kind of data now exposed here.

What makes SplitVPN's case particularly notable is the Russian operational context. VPN services headquartered in or operated from jurisdictions with mandatory data retention laws, weak privacy frameworks, or state-compelled disclosure obligations present elevated risk — regardless of their marketing claims. Users targeting censorship bypass are likely adversaries of the very governments that may compel such disclosures.

Who Is at Risk

The Structural Problem with VPN Trust Models
Activists, journalists, and dissidents using the VPN to evade state surveillance in Russia or neighboring jurisdictions
Users in censored regions who may now have their circumvention activity exposed to government actors
Privacy-conscious individuals whose device fingerprints, IP histories, and payment details are now in criminal hands
Enterprises or remote workers who may have used the service for cost-effective remote access — corporate IP patterns could now be reconstructed

The Altenen Forum Distribution: Criminal Exploitation Is Underway

The choice to distribute this dataset on Altenen — a known cybercrime forum — signals active criminal interest. Beyond government exposure risk, this data enables targeted phishing campaigns, credential stuffing attacks, SIM-swap fraud (via device and payment data), and identity theft. Users of this VPN should treat their associated accounts and payment methods as compromised.

What This Means for VPN Selection Going Forward

The market is flooded with VPN providers making identical "no-logs" promises. This breach should accelerate adoption of a more rigorous vendor evaluation framework. Key differentiators between trustworthy and untrustworthy providers include:
  • Independent third-party audits of logging infrastructure (not just policy documents)
  • Jurisdiction of incorporation and applicable data retention law
  • RAM-only server architecture that physically cannot persist logs across reboots
  • Warrant canaries and transparency reports with historical consistency
  • Open-source client code that can be independently verified
  • Public disclosure history — how has the provider handled past legal requests?

Shield53 Recommendations

If You Were a SplitVPN / NotVPN User

  • Assume your connection history is compromised. Treat all IP addresses, timestamps, and browsing patterns associated with VPN sessions as potentially exposed.
  • Rotate all credentials for accounts accessed during VPN sessions, particularly any using the same password as your VPN account.
  • Cancel and replace any payment methods used to subscribe — card data and billing details may be included in the breach.
  • Monitor for targeted phishing — threat actors with your email and device information will likely attempt follow-on attacks.
  • Assess legal exposure — if you are in a jurisdiction where VPN use carries legal risk, consult appropriate legal counsel.

For Organizations Evaluating VPN Providers

  • Require documented, third-party-audited no-logs policies before approving any VPN for corporate use.
  • Prefer providers incorporated in jurisdictions with strong privacy law (e.g., Switzerland, Iceland, Panama).
  • Enforce VPN usage only through approved, vetted providers via policy — shadow IT VPN use is an uncontrolled supply chain risk.
  • Treat consumer-grade VPNs as unsuitable for enterprise traffic regardless of their marketing claims.

This breach is a predictable outcome of an industry that has allowed marketing to outpace accountability. Until no-logs claims are routinely verified through independent technical audits — not just policy assertions — users are extending trust they have no basis to give. Shield53 strongly encourages both individuals and enterprises to treat VPN provider vetting as a critical security due diligence exercise, not an afterthought.