What the SplitVPN breach exposed

A VPN service called SplitVPN, marketed as a tool for bypassing internet censorship, is at the center of a data exposure that undercuts the very promise it sold to users. According to a report from Security Affairs, a stolen 17 GB SQL database allegedly tied to SplitVPN contained millions of user, device, and payment records, along with 58 million connection logs. That last detail is the one that matters most, because SplitVPN advertised itself as a no-logs service, meaning it claimed not to record the kind of activity data that could tie a user's identity to their online behavior.

The scale of the leak, tens of millions of connection records alongside payment and device information, suggests this was not a minor technical oversight. It points to a systemic practice of retaining exactly the data a no-logs policy is supposed to rule out. For a service built around helping people get around censorship, often in regions where digital surveillance carries real personal risk, that kind of exposure is more than an embarrassment. It is a direct contradiction of the safety promise users were relying on.

How a 'no logs' VPN ended up logging everything

The gap between what VPN providers say in their marketing and what actually happens on their servers is not a new problem, but the SplitVPN case is a stark reminder of how wide that gap can be. A "no-logs" claim is, at its core, a policy statement. It describes what a company says it will not do. Nothing about that statement is automatically verified by a technical mechanism or an outside party. Unless a provider submits to independent scrutiny, that claim exists only on a webpage.

What likely happened here is a common pattern in the VPN industry: connection metadata, timestamps, IP addresses, session details, and account information get collected for operational reasons such as troubleshooting, fraud prevention, or billing, and that data is never fully purged. Over time, it accumulates into exactly the kind of profile a no-logs policy claims doesn't exist. When a database like that is breached or left exposed, the mismatch between policy and practice becomes public in the worst possible way.

Why unaudited no-logs claims can't be trusted

This incident is a useful case study in why a no-logs claim, by itself, should never be treated as proof of privacy. Any VPN provider can write "we don't log your activity" on its homepage. The claim only becomes credible when it is backed by something external: a third-party security audit, a court case where authorities requested logs that genuinely didn't exist, or a transparent history of consistent public reporting. Without that kind of verification, a no-logs policy is a marketing statement, not a guarantee.

The broader lesson extends beyond VPNs. Plenty of security and privacy tools make bold promises that sound reassuring but are difficult for an average user to verify. The same skepticism that applies here is worth applying elsewhere in the security world; for instance, reporting on ransomware payments has similarly shown that a common assumption, in that case that paying a ransom resolves the problem, doesn't hold up once independent data is examined. Claims need evidence, not just intent.

How to vet a VPN's privacy policy before you trust it

Before subscribing to any VPN, especially one marketed for high-stakes use cases like bypassing censorship, it's worth doing a few concrete checks rather than taking the no-logs label at face value:

  • Look for a completed, published third-party security audit, not just a vague reference to being "audited." Reputable providers name the auditing firm and publish findings.
  • Check whether the provider has a documented history, ideally including instances where law enforcement requests confirmed no useful logs existed.
  • Read the actual privacy policy, not just marketing pages, to see what data categories are collected for billing, troubleshooting, or fraud prevention, and how long that data is retained.
  • Research the company's ownership and jurisdiction, since data retention obligations vary significantly by country.

What This Means For You

If you use SplitVPN, or any VPN, the SplitVPN no-logs data leak is a reminder to periodically reassess whether the service you're paying for backs up its privacy claims with real evidence. If your provider has never published an independent audit, that's worth treating as a red flag rather than a technicality. For users in censorship-prone regions, where a breach of connection logs could carry real personal consequences, this scrutiny isn't optional; it's essential.

Takeaways

The SplitVPN incident underscores a simple truth: a privacy promise is only as strong as the evidence behind it. Before trusting any VPN with your connection data, verify its no-logs claim through independent audits and transparency reports rather than relying on marketing language alone. Review your current provider's policy, check for third-party verification, and don't hesitate to switch if the evidence doesn't hold up.