SplitVPN Breach Exposes 58 Million Connection Logs and Shatters No-Logs Claims

The myth of absolute privacy in commercial Virtual Private Network (VPN) services has suffered another catastrophic blow. On July 21, 2026, a threat actor operating under the handle vhacker51 published a massive 17 GB SQL database on the infamous Altenen cybercrime forum. The compromised repository belonged to SplitVPN—a service formerly operating under the brand name NotVPN. Despite years of aggressive marketing promising a strict “no-logs” policy and guaranteeing “100% privacy” with zero saved activity or connection history, the leak exposed a terrifying reality: the provider was maintaining continuous, real-time connection logs for tens of millions of users right up to the minute the database was stolen. The SplitVPN breach serves as a watershed moment for digital privacy, laying bare the profound disconnect between commercial marketing claims and server-side data retention practices.

Independent verification by cybersecurity researchers confirmed that the stolen dataset is an authentic mysqldump export from a production MySQL database. Containing roughly 58 million VPN connection records alongside millions of user accounts, device identifiers, and payment tokens, this breach destroys the operational security (OpSec) assumptions of users worldwide. The exposure is particularly dangerous for citizens in heavily censored and monitored nations—such as Russia, Iran, India, and Myanmar—who relied on the service to bypass state-sponsored internet censorship and communicate safely. By cross-referencing connection timestamps with account metadata, third parties can now de-anonymize millions of individuals who believed their digital footprints were completely erased.

Anatomy of the Leak: What the SplitVPN Breach Revealed Inside the 17 GB SQL Database

The leaked dataset presents an unvarnished technical blueprint of SplitVPN’s internal logging mechanisms. Rather than operating a ephemeral infrastructure designed to purge volatile session data from RAM, the company maintained structured relational tables that cataloged granular operational metrics. A detailed breakdown of the compromised database includes:

• 58 Million Connection Logs (The deviceProxy Table): The most damning component of the breach is a continuous record of server connections spanning from June 2025 to July 21, 2026. This table records the precise hardware device ID, the destination VPN server ID, and the exact timestamp when each connection was established and terminated. The existence of logs generated on the exact day of the dump confirms that logging was actively occurring in real time.
• 23.4 Million User Records: The core account table exposes 23.4 million registered user profiles. The leaked fields include account email addresses, active subscription statuses, account creation dates, and the last-seen real-world IP addresses used to log into the service platform.
• 13.6 Million Device Records: Hardened device-tracking tables detail 13.6 million unique hardware signatures. This data includes unique device identifiers (UUIDs), operating system builds, installed app versions, and local hardware configurations designed to track user hardware across multiple sessions.
• 2.6 Million Payment Records: Financial metadata within the database accounts for 2.6 million billing entries. While full credit card numbers were not exposed due to payment gateway masking (limiting card data to Bank Identification Numbers [BIN] and the last four digits), the table contains subscription tier details, transaction histories, expiration dates, and recurring billing tokens.

The Mechanism of Deception: How deviceProxy Invalidates “No-Logs” Promises

To understand why the SplitVPN breach is so devastating to user anonymity, one must dissect the technical architecture of the database structure. Commercial VPN providers often engage in clever semantic gymnastics, distinguishing between “activity logs” (the specific URLs or web traffic transmitted through the tunnel) and “connection logs” (metadata regarding when and where a user connects). While the 17 GB database does not appear to contain full HTTP packet captures or DNS query histories, the metadata recorded in the deviceProxy table is functionally sufficient to destroy user anonymity.

In relational database engineering, linking tables via primary and foreign keys allows complex data correlation. By joining the users.id primary key with the device.id and deviceProxy.timestamp records, an analyst can construct a complete temporal connection timeline. For example, if an intelligence agency or network adversary knows that a specific censorship-circumvention tool or target IP was accessed from a VPN exit node at a precise millisecond, they can query the deviceProxy log for matching session timestamps. Cross-referencing that entry with the user’s last-seen real IP address and email account completes a deanonymization chain, directly tying a real-world human identity to specific network events.

Furthermore, the continuous recording of timestamps proves that SplitVPN’s system was engineered specifically to store historical connection data. True “zero-logs” architectures operate entirely on volatile memory (RAM disk images) where session state is maintained strictly in-memory and immediately overwritten upon connection termination. The presence of a persistent, disk-backed MySQL table recording 58 million connection events demonstrates a deliberate administrative choice to archive metadata over an extended multi-month window.

Geopolitical Fallout: Operational Security Risks for Censorship-Heavy Regions

The geopolitical ramifications of the SplitVPN breach are immediate and severe. SplitVPN (and its former iteration NotVPN) actively positioned itself as a critical privacy bridge for citizens residing in authoritarian environments. In countries like Russia, Iran, India, and Myanmar, the state maintains aggressive deep packet inspection (DPI) firewalls, restricts access to independent news outlets, and enforces severe penalties for political dissent or bypassing official digital blocks.

For users in these high-risk jurisdictions, digital privacy is not a matter of hiding casual streaming activity; it is a fundamental safety requirement. State surveillance agencies regularly subpoena or intercept local Internet Service Provider (ISP) logs. When an adversary combines local ISP records—showing that a user connected to a known SplitVPN entry server at a specific time—with the leaked 17 GB database showing that same user’s real-world IP address, hardware UUID, and account email, the user’s operational cover is completely shattered.

Human rights defenders, independent journalists, and political dissidents who relied on SplitVPN’s assurances now face heightened risks of targeted spear-phishing, physical surveillance, and legal prosecution. Security analysts strongly advise anyone who ever registered an account with NotVPN or SplitVPN to consider their associated email address, real-world IP history, and device parameters permanently compromised.

Beyond Marketing Claims: Reconstructing True Digital Anonymity

The exposure of SplitVPN underscores a fundamental flaw in the modern consumer security ecosystem: relying on unverified corporate promises. When a company claims “100% privacy guaranteed” on a landing page, users are asked to place blind trust in opaque server configurations that they cannot audit. Reclaiming genuine digital anonymity requires moving away from single-point-of-failure commercial services and adopting defense-in-depth methodologies.

To establish resilient operational security that does not depend on marketing claims, users must implement multi-layered cryptographic and architectural safeguards:

1. Mandate Independently Audited RAM-Only VPNs: If a commercial VPN must be used, select providers that undergo frequent, published third-party security audits by reputable auditing firms. Furthermore, insist on diskless RAM-only server deployments where operating systems run entirely in volatile memory, making long-term database storage technically impossible.
2. Utilize Decentralized Multi-Hop Networks (Tor & I2P): For high-risk activities where attribution carries physical danger, reliance on a single VPN provider is inherently insufficient. Routing traffic through decentralized, multi-hop onion routing protocols—such as the Tor network—ensures that no single node or service provider possesses knowledge of both the user’s origin IP address and their destination site.
3. Enforce Strict Browser Anti-Fingerprinting & Hardware Isolation: Device UUIDs leaked in the SplitVPN database highlight how hardware tracking compromises user identities. Users should leverage hardened operating systems like Tails or Qubes OS, run browser configurations designed to neutralize canvas and hardware fingerprinting, and utilize ephemeral virtual machines that reset after every session.
4. Adopt Zero-Knowledge Cryptographic Authentication: Next-generation privacy architectures are shifting toward tokenized, zero-knowledge proof (ZKP) systems. In a zero-knowledge ecosystem, the service provider authenticates subscription rights without ever knowing or storing the user’s real identity, email address, or payment details.

Conclusion: The End of Blind Trust in Privacy Infrastructure

The exposure of 58 million connection logs from SplitVPN stands as an unequivocal warning to the global privacy community. It proves that marketing claims in the consumer privacy industry can be radically detached from underlying engineering realities. A “no-logs” policy written in HTML is completely meaningless when backed by a persistent MySQL database actively recording millions of connection timestamps behind the scenes.

As threat actors, corporate data brokers, and state surveillance apparatuses become increasingly sophisticated at cross-referencing disparate datasets, the cybersecurity industry must abandon blind trust. True digital anonymity cannot be purchased with a monthly subscription—it must be architected through decentralized technologies, open-source verification, cryptographic minimization, and relentless personal operational security.