2026 SplitVPN (NotVPN) — HIBP 865.3k emails; ~58M connection logs (no-logs claim)
Data compromised
HIBP: 865.3k unique emails, IP addresses, country/geo, device info, partial payment cards (BIN + last 4 + expiry). Researcher corpus also cites ~23.4M user rows, ~13.6M devices, ~2.6M payment records, ~58M connection logs (device↔server↔time) contradicting “no logs” marketing
Technical writeup
HIBP-verified published corpus — added August 1, 2026. SplitVPN (formerly NotVPN), a Russian VPN marketed for bypassing censorship, appeared in an Altenen forum dump dated about July 21, 2026. Have I Been Pwned indexed 865.3k unique email addresses with IP addresses, geographic/country fields, device information, and partial credit-card data (first 6 + last 4 digits plus expiry). Troy Hunt noted ~37% of those emails were already in HIBP. Independent analysis by Mysterium (covered by SecurityAffairs) verified a ~17GB SQL dump with approximately 23.4 million user records, 13.6 million devices, 2.6 million payment records, and ~58 million connection-log rows (deviceProxy: device, server, timestamp from June 2025 through the dump day) — contradicting NotVPN’s “no logs or history” marketing. No full PANs; recurring billing tokens and last-seen IPs cited. Catalog indexes HIBP’s 865,300 unique emails as recordsAffected; larger row counts remain researcher/actor corpus figures. Company confirmation not reviewed at indexing.
Root cause
Customer database dump circulated on Altenen (dump dated ~July 21, 2026); Mysterium verified corpus; HIBP loaded unique emails Aug 1, 2026