A “No-Logs” VPN That Kept 58 Million Connection Logs: Inside the NotVPN / SplitVPN Breach

Key Takeaways

• A threat actor on the Altenen cybercrime forum is distributing a 17 GB SQL database they claim was stolen from SplitVPN (formerly NotVPN), a Russian VPN used to bypass internet blocks.
• The Mysterium research team obtained a copy and verified it against the raw dump. The data is real, and the headline numbers check out: ~23.4 million user records, ~13.6 million devices, ~2.6 million payment records — and, most damningly, ~58 million connection logs.
• NotVPN’s own marketing promises “No logs or history: We never store your activity or connection logs. 100% privacy guaranteed.” The database contains a table (deviceProxy) that records which device connected to which server, and exactly when — nearly 58 million times, right up to the day of the breach.
• No full credit-card numbers were exposed (card data is masked to BIN + last four). But emails, IP addresses, device identifiers, approximate location, subscription status, and recurring-billing tokens were.
• If you used NotVPN or SplitVPN, treat the email and IP tied to your account as compromised. Practical steps are at the end of this post.

What Was Leaked?

On the carding and data-leak forum Altenen (ATN), a long-tenured user operating under the handle vhacker51 posted a thread titled “SplitVPN (NotVPN) 23.4M users, 58M logs, 13.6M devices.” The listing describes the target as “a Russian VPN service for bypassing blocks, with users from Russia, Iran, India, Myanmar,” gives a dump date of 21 July 2026, and offers a compressed SQL file for download. The leak has since been picked up publicly by breach-tracking accounts such as Dark Web Informer.

We don’t link to the download, name victims, or reproduce personal data in this write-up. What follows is a verification exercise: does the stolen database actually contain what the seller claims, and what does it reveal about how the service treated its users?

How We Verified It

The dump is a standard mysqldump export of a MySQL 5.7 database whose internal name is, simply, notvpn. Rather than take the seller’s word for the record counts, we examined the raw 17 GB file directly: the table schemas, the AUTO_INCREMENT counters (which track how many rows a table has issued), and thousands of sampled rows across the sensitive tables. Every personal detail in the examples below has been redacted or reduced to a structural description.

The database contains 60+ tables. The ones that matter:

The counts aren’t just “close” — for several tables they're near-exact matches to the seller’s advertised figures, which is what you would expect from a genuine, unmodified export rather than a fabricated listing.

A “No-Logs” VPN With 58 Million Logs

NotVPN’s marketing copy, quoted in the seller’s own post with visible sarcasm, reads:

“Complete privacy and data protection: Your data is always encrypted and protected from third parties.” “No logs or history: We never store your activity or connection logs. 100% privacy guaranteed.”

The database tells a different story. The deviceProxy table has an almost trivially simple structure:

• deviceProxy
• id      — row number
• device  — which device (links to the device table → to a user
• proxy   — which proxy/server node
• time    — Unix timestamp

That’s a connection log. Every row says “this device used this server at this moment.” There are close to 58 million of them, and the timestamps run continuously from June 2025 to 21 July 2026 — the very day of the dump. These aren’t stale test records; the service was still writing connection logs as it was being breached.

An important nuance, in fairness to accuracy: deviceProxy records the server node a device connected to and the time — it doesn’t appear to store the destination websites a user visited. So this is connection metadata, not full browsing history. 

But metadata is precisely what “we never store your connection logs” promises not to keep. Cross-referenced with the users table (which holds the account email and last-seen IP) and the device table (which holds hardware identifiers), those 58 million rows are more than enough to reconstruct who connected, from where, to which server, and when — for tens of millions of people, many of them in countries where using a VPN at all can carry personal risk.

This is the core finding. A VPN’s single most important promise is that it doesn’t keep the records that would let anyone reconstruct your activity. NotVPN kept them by the tens of millions.

What Else Is in the Data

• User records (~23.4M): Email address, the IP the account was last seen from, language, country/detected country, operating system and app version, and subscription state (Apple or Tinkoff). Emails we sampled are ordinary, real consumer addresses.
• Devices (~13.7M): Per-device identifiers including Apple identifierForVendor UUIDs and MD5 device hashes, push-notification tokens, and IP addresses — the raw material for tracking a specific handset over time.
• Payments (~2.6M): Records from the Tinkoff payment gateway: masked card numbers (e.g. 430000******0777), expiry dates, amounts, payment IDs, and (notably) RebillId recurring-billing tokens. We want to be precise here: full card numbers are not present; the PAN is masked to the first six and last four digits, which is standard gateway behavior. The exposure is the linkage between a person’s email, their spending, and a recurring-payment token — not directly a usable card number.
• Admin panel (5 accounts): The admins table holds logins — pavel, valerii, maria, andrei, vladislav — with bcrypt password hashes and roles (admin/operator). Bcrypt is a strong, slow hash, so these aren’t instantly crackable, but the operator identities and the entire admin action log are laid bare. Account creation dates run from January to June 2026.
• Telegram & Apple ID infrastructure: Tables such as telegram and appstore_account, plus internal notes in Russian referencing “Telegram Apple ID Email,” point to back-office machinery for provisioning App Store accounts — the plumbing behind distributing a VPN that app stores in Russia have been actively removing.

Who Is Exposed and Why It’s Serious

The seller lists the user base as concentrated in Russia, Iran, India, and Myanmar. Look at that list again. These are places where people reach for a VPN specifically to get around state censorship: to read independent news, to use blocked messaging apps, to speak freely. For those users, a leaked email-plus-IP-plus-timestamp record isn’t an abstract privacy nuisance. It’s a document that ties a real person to the act of evading state controls, sitting in a file now circulating on a criminal forum.

That is the cruel inversion at the heart of this breach: a tool sold as protection became a central, high-value repository of exactly the evidence its users were trying not to create.

Why This Keeps Happening

It would be easy to frame this as one dishonest operator. It’s more useful to see the structural problem, because it’s not unique to NotVPN.

A conventional VPN is a centralized intermediary. All of your traffic routes through infrastructure the provider controls, and the provider (not you) decides what gets written to a database. “No-logs” is, in this model, a pinky-promise: a marketing claim you can’t inspect, backed by nothing you can verify. 

When the provider logs anyway (whether for anti-fraud, billing, capacity planning, or less benign reasons), you have no way to know until a 17 GB file with your email in it shows up on a forum. And because everything is in one place, that one database is a single point of catastrophic failure — a honeypot that concentrates millions of people’s exposure into a single breachable target.

This is the problem decentralized VPNs are built to remove. In a VPN with decentralized infrastructure like Mysterium VPN, there’s no central server logging every connection, because there’s no central server. The network is a distributed set of independently operated nodes; no single party sits in a position to record “who connected to what, and when” for the entire user base, and there is no master database of 23 million emails waiting to be stolen. 

Payments and access are designed so that the operator doesn’t need to hold a honeypot of personal and financial data in the first place. We say this plainly and with an obvious interest in the point: you shouldn’t have to trust a promise you cannot audit. The right architecture removes the need to trust it at all.

We would make the same argument if a decentralized service were caught doing this. The lesson is architectural, not tribal: if a system can keep logs on everyone, eventually some copy of those logs leaks.

If You Used NotVPN or SplitVPN

Treat the email address and the IPs associated with your account as compromised, and act accordingly:

1. Change your password on the email account tied to your NotVPN/SplitVPN registration, and anywhere you reused that password. Turn on two-factor authentication.
2. Watch for targeted phishing: Leaked-VPN user lists are prime material for extortion and phishing that references your VPN use to seem credible. Be skeptical of any message that claims to “know what you accessed.”
3. If you paid via Tinkoff, monitor your statements. Your full card number wasn’t exposed, but your email is now linked to your payment history; be alert to any unexpected recurring charges and contact your bank if you see them.
4. Assume the connection metadata is out there: If you were using the service to bypass censorship in a high-risk environment, factor into your threat model that records of when your device connected to which server now exist outside the operator’s control.
5. Move to a provider whose privacy claims you can actually verify — ideally one whose architecture doesn’t require you to trust an un-auditable “no-logs” pledge.

Methodology & Responsible-Handling Note

The Mysterium VPN research team analyzed a copy of the leaked database solely to verify the breach and characterize the exposure. We didn’t redistribute the data, contact or de-anonymize any individual in it, or reproduce any personal record. All identifiers in this post are redacted or described structurally. Row counts were confirmed against table metadata and sampled directly from the raw export. Where the seller’s claims overstate what the data holds — for example, implying the logs include browsing destinations — we have said so.

Sources: threat-actor listing and profile on the Altenen (ATN) forum; public breach tracking by Dark Web Informer; direct analysis of the leaked notvpn MySQL export. Reporting on the wider takedown of VPN/proxy apps in Russia via Cybernews, TechRadar, and Comparitech.