A no-logs VPN leak has produced one of the clearest contradictions the industry has seen this year. A 17 GB database attributed to SplitVPN, a Russian service formerly branded NotVPN and sold as a way around internet blocks, surfaced on a cybercrime forum on 23 July 2026. Analysis published on 29 July found that the service had been writing connection logs continuously for more than a year, while its own marketing promised it never stored any.
What is actually in the database
The research team at Mysterium obtained a copy of the dump and checked the table structures, counters and sample records against the raw file. The figures they confirmed:
- 23.4 million user records.
- 13.6 million device records.
- 2.6 million payment records.
- Nearly 58 million rows in a table named deviceProxy.
That last table is the whole story. Each row ties a device to a specific VPN server and the exact time it connected. The entries run continuously from June 2025 to 21 July 2026, the day the database was pulled. Alongside them sit email addresses, last-seen IP addresses, country, subscription status, masked card numbers with transaction amounts and timestamps, authentication tokens, device identifiers, linked Telegram accounts and Apple IDs, WireGuard peer data, server metrics and five administrator accounts with bcrypt password hashes.
What the service promised
The marketing copy is not ambiguous. NotVPN told its users: "No logs or history: We never store your activity or connection logs. 100 percent privacy guaranteed." The deviceProxy table is, by definition, a connection log. It was still being written to on the day of the breach.
The claim that did not survive checking
When the archive first appeared for sale, the seller advertised it as containing the resources users' traffic was directed to, which would mean browsing history. That part did not hold up. The analysis found no visited website addresses and no browsing history in the database. What it found was metadata: who connected, from which address, to which server, at what moment.
This distinction matters, and it cuts in an uncomfortable direction. Metadata is often dismissed as the harmless half of surveillance. For someone using a VPN to read blocked news, it is not. An email address tied to an IP address and a precise connection timestamp does not reveal what a person read, but it does prove that the person was using a censorship-circumvention tool at a given moment from a given place. In a country where that use is itself the problem, the content is beside the point.
Who this lands on
According to the seller, the user base is concentrated in Russia, Iran, India and Myanmar. That is not a coincidence: those are precisely the markets where demand for circumvention tools is driven by state filtering. Russia alone has spent the past year escalating from throttling to a mass ban of MTProto proxies and VPN endpoints, and the state has been building its own visibility into who uses what, including a state-backed messenger caught detecting VPN use and logging private chats.
The people most exposed by this leak are therefore the people who had the strongest reason to trust the promise on the label. They chose a product marketed on privacy, in a place where being identified as a VPN user carries real consequences, and the product kept a year of records proving exactly that.
Why "no logs" is a claim, not a fact
A no-logs policy is a sentence on a website until something forces it to be tested. There are only three things that put weight behind it: an independent audit by a named firm with a published report, a track record of court orders or seizures where the provider genuinely had nothing to hand over, and infrastructure choices such as RAM-only servers that make retention difficult by design. A slogan on a landing page is none of those.
Paying for a subscription does not close that gap either. This service took payments, and 2.6 million payment records are in the dump. Money buys a product; it does not buy verification. The same failure of accountability is what makes free VPNs questionable and often dangerous, and the mechanism is identical at any price: a provider nobody has checked, holding data it said it would not hold.
The researchers who examined the dump advise anyone who used NotVPN or SplitVPN to treat the email address and IP tied to that account as compromised: change any password reused with that email, turn on two-factor authentication, expect targeted phishing that references VPN use, and check the card statements behind those payment records. The broader lesson is to weight providers whose no-logs claims have actually been tested over those that merely assert it, and to pick tools built to survive DPI filtering if circumvention is the reason you need one at all.
