Loading story…
SplitVPN, formerly known as NotVPN, was reportedly breached, exposing a 17 GB SQL database containing nearly 58 million connection logs and millions of related records, undermining the provider’s public "no-logs" claims. Analysis cited by Mysterium found roughly 23.4 million user records, 13.6 million device records, and 2.6 million payment records, with connection metadata spanning from June 2025 to July 21, 2026. The leaked database was reportedly circulated on the Altenen cybercrime forum.
The exposed information allegedly includes email addresses, IP addresses, device identifiers, approximate location data, subscription status, masked payment card details, expiration dates, recurring billing tokens, and records showing which users connected to which VPN servers and when. Reports also said the dump contained five administrative accounts with bcrypt password hashes, operator action logs, and references to back-office infrastructure used for App Store account provisioning. The breach is particularly serious because SplitVPN is marketed as a censorship-circumvention service, with many users reportedly located in Russia, Iran, India, and Myanmar, raising privacy and personal safety risks for people relying on the VPN for anonymity.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Have I Been Pwned added the SplitVPN breach to its database and reported 865,336 affected accounts tied to the incident. The reference says HIBP listed the incident as having occurred on July 21, 2026.
The exposed SplitVPN SQL database reportedly contained connection-log metadata covering activity from June 2025 through July 21, 2026, along with user, device, and payment records. The presence of these logs directly contradicted the service's public no-logs claims.
Mysterium's research team reportedly verified and analyzed the leaked SplitVPN database, identifying about 23.4 million user records, 13.6 million device records, 2.6 million payment records, and nearly 58 million connection logs. The analysis also found admin account password hashes, operator action logs, and infrastructure details.
A 17 GB SQL database allegedly stolen from SplitVPN was reportedly distributed on the Altenen cybercrime forum. The leaked data included tens of millions of user, device, payment, and connection-log records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcemalware.news
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourcehaveibeenpwned.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A dataset tied to the **FortiBleed** campaign exposed credentials associated with internet-facing Fortinet and FortiGate devices used for SSL-VPN remote access, affecting organizations in **194 countries**. Researchers reported that the collection grew from roughly **73,000** compromised devices to **86,644** firewalls and VPN gateways, and included VPN URLs, usernames, email addresses, and in many cases **plaintext passwords**. Italian authorities warned that the circulating dataset was specifically linked to exposed SSL-VPN credentials on internet-accessible Fortinet systems. Independent validation found that some leaked credentials were authentic and still worked on exposed devices, including systems running recent **FortiOS** versions. Investigators linked the database to active threat actors conducting large-scale scanning, compromising devices, intercepting traffic, and using stolen access to move into internal networks; some follow-on intrusions reportedly ended with ransomware-style encryption of hundreds of systems. Analysis also indicated that both default or built-in Fortinet accounts and organization-created accounts were present in the leak, pointing to weak credential hygiene and credential reuse as contributing factors, while the original intrusion vector remained unknown.
Aug 1, 2026
Researchers and media reports disclosed enormous troves of exposed login data, including an unprotected 47.42 GB database containing **184,162,718** unique usernames and passwords tied to services such as Microsoft, Facebook, Google, Instagram, Snapchat, Discord, Netflix, PayPal, and government portals in 29 countries. Security researcher Jeremiah Fowler found the database on an unmanaged server with no password protection or encryption, and sample records included account types, website URLs, and plaintext passwords labeled `senha`. Fowler said multiple individuals confirmed the leaked credentials were genuine after he contacted them directly. The exposed records are believed to be linked to **infostealer malware** and broader malware-as-a-service collection operations, with subsequent reporting describing a far larger cache totaling **16 billion** credentials affecting major consumer platforms including Apple, Facebook, and Google. The disclosures raise immediate risks of credential stuffing, account takeover, phishing, fraud, and unauthorized access to corporate and government systems. Public access to the 184 million-record database was later restricted after responsible disclosure to the hosting provider, but the owner of the data remains unidentified.
Jun 29, 2026
A threat actor has advertised an alleged **Revolut** customer database for sale on a cybercrime forum, claiming it contains more than **75 million records** tied to the fintech platform. Reported samples include personally identifiable information, account identifiers, device metadata, partial payment card details, and hashed credentials, raising potential risks of phishing, identity theft, and fraud if the data is authentic. Revolut said it has found **no evidence of unauthorized access** or a new compromise of its systems, and researchers have not verified the seller’s claims. Early analysis indicates the records may extend to around **May 2025**, but investigators suspect the dataset could be an aggregation of historical or unrelated leaks rather than proof of a fresh breach; both the company and outside researchers say technical evidence such as authenticated exports or forensic logs is still lacking.
Jul 30, 2026