SplitVPN data breach
865,336 accounts exposed in a breach on 21 July 2026.
At a glance
865,336
Accounts exposed
21 July 2026
Date of the breach
1 August 2026
Added to the list
What happened
In July 2026, the Russian VPN service SplitVPN (previously known as NotVPN) suffered a data breach. The incident exposed millions of customer records, including 865k unique email addresses. Other impacted data included IP addresses, the user's country, and partial payment card data (first 6 and last 4 digits plus expiry date).
What was exposed
- Device information. Details of your devices were exposed. They show what you use but cannot be used to log in.
- Email addresses. Email addresses were exposed. Expect more spam and phishing aimed at those addresses.
- Geographic locations. General locations were exposed. They add to a profile of you.
- IP addresses. Internet addresses were exposed. They show roughly where and how you connect. They cannot be used to log in.
- Partial credit card data. Part of a payment card number was exposed. On its own it is limited, but scammers use it to sound convincing.
What to do now
It depends on what was exposed, so these steps follow the list above.
If payment details were exposed
- Check your bank and card statements for charges you do not recognise.
- Tell your bank. Ask about replacing the card or watching the account.
- Be wary of calls or messages that say they are from your bank and ask you to move money or read out a code.
If your contact details were exposed
- Expect more spam, scam calls and phishing. Do not click links or open attachments in messages you did not expect.
- If a message mentions this breach, do not reply. Go to the organisation's own website or app instead of using a link in the message.
Whatever was exposed
- Check which other breaches include your own email address and phone number.
- Keep an eye on your accounts for a few months. Breached data is often used long after the breach.
- If you think someone is using your details, report it to the organisation and to your national cyber crime reporting service.
Check your own exposure
- Password leak check: find out whether a password has appeared in a breach. The password never leaves your browser.
- Free domain security scan: grade the email, DNS and website security of a domain you own.
Related breaches
Other breaches that exposed some of the same kinds of data.
Manchester Airports Group
In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services.
- Browser user agent details
- Email addresses
- Geographic locations
- IP addresses
- +4 more
Read what happened
Paidwork
In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale.
- Bank account numbers
- Dates of birth
- Device information
- Education levels
- +10 more
Read what happened
Edmunds
In January 2026, the automotive research and car-shopping platform Edmunds was listed by the ShinyHunters hacking group as having been breached.
- Device information
- Email addresses
- IP addresses
- Passwords
- +2 more
Read what happened