The VPN SplitVPN, popular among Russians, has been hacked. Hackers are already selling user data
What they constantly warn about: "free/cheap VPN = you are the product yourself." Hackers claim they gained access to SplitVPN customer data and put it up for sale. Thousands of users could be affected. The service promised "complete confidentiality" and "no logs" until the very end. A classic.
And now for the funniest part. SplitVPN's privacy policy explicitly stated that the company may collect some data and share it with third parties. So formally they didn't violate anything — it's just that users, as usual, didn't read the fine print.
What's important to understand:
- "No-logs" in marketing and "no-logs" in reality are often two different things.
- If a VPN is registered in a jurisdiction where data can easily be obtained, or simply stores something "to improve the service" — there's always a risk.
- A breach of a database containing emails, payment information, IP addresses, or connection history is no longer a theory but concrete harm.
As an IT specialist, I'll say it straight: most mass-market VPNs, especially those actively promoted in the Russian-speaking segment, survive on either advertising, selling data, or both. True no-logs is expensive, difficult, and almost always paid. And even then, you should check the audits.
What to do right now if you used SplitVPN:
- Change passwords everywhere that email was linked.
- Check whether your payment data was leaked.
- Switch to a trusted service with an independent audit (and preferably with open source or a strong reputation).
- Enable 2FA everywhere possible.
A VPN is a tool, not a magic "I'm safe" button. If a service promises perfect privacy but says the opposite in its policy — believe the policy, not the advertising.
