The ‘no-logs’ VPN that allegedly logged everything: what the SplitVPN leak actually shows
On July 21, a vendor on the Altenen cybercrime forum put up an SQL archive weighing 17 gigabytes, said to have been lifted from the infrastructure of SplitVPN, a Russian service that previously operated as NotVPN. The listing promised 23.4 million user records, 13.6 million device records, and, most damagingly for a service whose marketing promised total privacy, 58 million connection logs.
A week later, researchers at Mysterium, a decentralized VPN provider, said they secured a copy of the archive and validated its contents directly against the raw export. Their conclusion: the tallies lined up almost perfectly with what the seller advertised, the kind of consistency expected from a real, untouched database file, not an invented one. The file turned out to be a mysqldump export from a MySQL 5.7 instance whose database carries the internal label “notvpn,” spanning more than 60 tables.
The table that contradicts the promise
The centerpiece is the “deviceProxy” table, a minimal structure mapping a device, a proxy server, and a Unix timestamp. Mysterium counted roughly 58 million rows, with timestamps that run without gaps from June 2025 up to the moment the archive went on sale. In other words, the service appears to have been writing connection records right up until it was breached.
That sits awkwardly next to the company’s own materials, which insisted it never stored activity or connection logs and that user data was fully protected.
One nuance matters: the table records which device connected to which server node and when, connection metadata, not the websites users visited. The researchers explicitly corrected the seller’s implication that browsing destinations were captured. But this is exactly the kind of record the service promised not to keep. Combined with the user table’s stored emails and last-seen IPs and the device table’s hardware fingerprints, the timestamps let someone reassemble a detailed picture of when a given account was active on which node, a reconstruction that works for tens of millions of records at once.
What else is in the file
Beyond the logs, the database reportedly contains roughly 23.4 million user records with email addresses, last-seen IPs, countries, OS and app versions, and subscription status; around 13.6 million device records including Apple identifierForVendor UUIDs, MD5 device hashes, and push-notification tokens; and about 2.6 million payment records from the Tinkoff gateway, with masked card numbers, expiry dates, and RebillId recurring-billing tokens. Full card numbers are not present, only the standard first-six/last-four masking, but the linkage between an email, a payment history, and a recurring-billing token is itself sensitive. The dump also exposes an admin panel with five accounts, bcrypt password hashes, and a complete action log.
Most of the accounts trace back to Russia, Iran, India, and Myanmar, places where using a VPN is often the only route around state internet controls. For those users, a record linking an email address to an IP and a timestamp is not an abstract privacy nuisance; it is evidence that a real person sought to circumvent government controls, and that evidence is now circulating on a criminal forum.
The company’s rebuttal
In response, SplitVPN acknowledged to TechRadar that the account-level metadata in the file (emails, countries, subscription status, masked card numbers, device names) is real, but called the deviceProxy table a fiction invented to make the archive more valuable. The company denied creating or keeping device-server-timestamp records of any kind, and said the exposed material amounts to basic account information that its no-logs commitment permits. It also said it replaced every VPN node’s IP address, swapped credentials and encryption keys, fixed the exploited flaw, and commissioned an external security audit; it described operations as back to normal.
Neither position is fully verifiable from outside. Mysterium’s methodology (checking table schemas, AUTO_INCREMENT counters, and sampled rows against the raw file) is the strongest independent evidence the logs are real. The company’s denial is a statement of intent, not a technical demonstration. Have I Been Pwned added the breach on August 1, listing 865,300 unique email addresses.
The lesson is architectural
Whichever version is true, the incident exposes the structural weakness of the no-logs model: the classic VPN setup funnels every user’s traffic through infrastructure the provider owns, leaving the provider, not the subscriber, in charge of what ends up in a database. A promise that cannot be audited is a promise that rests on trust alone. That is why the industry’s most credible providers submit to independent audits, RAM-only server designs, and architectures that make large-scale logging structurally difficult.
For former NotVPN or SplitVPN users, the practical guidance is straightforward: treat the associated email address and IP as compromised, change reused passwords, enable two-factor authentication, watch for phishing that references VPN usage, and monitor payment statements for unexpected recurring charges, especially if they paid through Tinkoff. The metadata, if real, now exists outside the operator’s control, and no amount of denial changes that.