Has NordVPN Been Hacked? Every VPN Breach Since 2015

Yes, NordVPN has been hacked once that we can document. One server, rented in a Finnish data centre, was entered in March 2018 via a remote-access tool that the hosting company had installed without NordVPN's knowledge. NordVPN disclosed it on 21 October 2019. The intruder could reach an expired internal private key. According to NordVPN, the server held no logs of what customers did. A separate claim in January 2026, by a forum user called “1011”, was denied by NordVPN as dummy test data, and nothing we have read shows customer data was involved.

The NordVPN incident is one entry in a longer record. This page sets out every VPN incident we could verify from 2015 to 2026, what each one actually exposed, and how the provider responded, so you can judge a provider on its record rather than on headlines. It covers paid and free services, and it separates three different things that are often lumped together: servers being broken into, data being left exposed, and providers handing data to authorities.

The short answer about NordVPN

The 2018 breach was real but narrow. TechCrunch's report of 21 October 2019, based on NordVPN's statement, says the server had been active for about a month, that the attacker used a remote-management system NordVPN did not know existed, and that the exposed key could not have been used to decrypt VPN traffic on any other server. NordVPN delayed disclosure until it had checked the rest of its infrastructure, and that delay drew as much criticism as the breach itself. TorGuard disclosed at the same time that one of its servers had been compromised in 2017, while denying VPN traffic was accessed, and records posted online suggested VikingVPN may have been affected too; VikingVPN did not comment.

The 2026 episode was different. On the weekend before 5 January 2026 someone using the name 1011 claimed on a hacking forum to have pulled more than ten databases, including source code and API keys, from a misconfigured NordVPN development server. NordVPN told BleepingComputer the material was dummy data from a trial account on a third-party automated-testing vendor's platform, never connected to its production systems. We describe it as a claim that NordVPN denied, not as a breach.

Outside firms have now examined NordVPN's no-logs claim six times; Deloitte's most recent visit closed in December 2025. If you want that record in context, our no-logs audit tracker lists it next to every other provider's. If NordVPN fits after reading this page, its plans are here; that is an affiliate link.

The timeline: 2015-2026 incidents

The chart puts every verified incident on one line. Red marks a breach or leak, ochre a provider handing over data, and green a legal demand that produced nothing, which is the kind of test a no-logs claim should pass. The sections below describe each one with its source.

2015: Hola

8chan's operator reported in May 2015 that traffic flooding his forum had come via Hola users' connections, a claim covered by ZDNet and other outlets. Hola's free service worked by routing other people's traffic through its free users' devices, and that capacity was sold to business customers through a sister service then called Luminati, later Bright Data. Hola's FAQ today still says free users share a small fraction of their device's resources, used for business purposes by Bright Data, while Premium users are never used as a peer.

2016 to 2017: IPVanish, ExpressVPN and PureVPN

In 2016 IPVanish, under an earlier owner, gave identifying connection data about a customer to US Homeland Security investigators, despite a policy that said it never logged. TorrentFreak reported it from court papers in May 2018. In January 2017 Turkish investigators seized an ExpressVPN server during the inquiry into the killing of the Russian ambassador and found no activity or connection logs on it. In October 2017 it emerged that PureVPN data had helped the FBI link a Massachusetts man, named in press reports as Ryan Lin, to a cyberstalking campaign. Critics said that contradicted PureVPN's zero-log marketing; PCMag argued it had kept connection logs, not activity logs.

2018 to 2021: NordVPN, UFO VPN, three Android apps, Windscribe

After the NordVPN breach came the free-app exposures. On 1 July 2020 Comparitech found UFO VPN's database open on the internet: 894 GB, more than 20 million log entries a day, plain-text passwords, VPN session secrets, user and server IP addresses and device details, all from a service that advertised no logs. In late February 2021 a hacking-forum user offered data from three Android apps, SuperVPN, GeckoVPN and ChatVPN, covering more than 21 million users, including emails, password strings, payment information and device IDs, according to Malwarebytes; the developers did not confirm it.

In June 2021 two Windscribe servers in Ukraine were seized by local authorities investigating activity from a year earlier. Windscribe disclosed on 7 July 2021 that the disks were not encrypted and held an OpenVPN server certificate and its private key, which could in theory let an attacker on a user's network impersonate a server under several conditions. It replaced its certificate authority on 20 July 2021 and committed to moving its servers to in-memory operation. Windscribe said no customer traffic data was at risk because it did not log it.

2023 to 2026: SuperVPN again, Mullvad, TunnelVision, 1011

On 24 May 2023 the security researcher Jeremiah Fowler, publishing through vpnMentor, reported an unprotected database linked to SuperVPN with 360,308,817 records totalling 133 GB, including email addresses, original IP addresses, geolocation and links to websites users had visited. On 18 April 2023, by contrast, Swedish police searched Mullvad's Gothenburg office for computers holding customer data and left without taking anything. Researchers at Leviathan Security Group published TunnelVision (CVE-2024-3661) that May: someone sharing your local network can redirect traffic so it skips a route-based VPN tunnel entirely, leaving the encryption intact but unused. Then came the 1011 claim against NordVPN in January 2026.

What actually leaked in each (severity matrix)

Headlines treat all of these as “VPN hacked”. They are not equally serious. The question that matters to a user is whether anything tied to their activity or identity escaped. The table rates each incident on the evidence in the sources above.

Two patterns stand out. The incidents that exposed what users actually did came from services that kept logs while saying they did not: UFO VPN, SuperVPN, IPVanish in 2016 and, by its critics' reading, PureVPN. The incidents at providers that genuinely kept little, NordVPN, TorGuard and Windscribe, exposed infrastructure secrets that were serious but did not reveal anyone's browsing. A breach of a server that holds no user data is a security failure; a breach of a database full of logs is a privacy disaster.

Free-VPN log leaks

The largest leaks in this timeline all came from free apps. UFO VPN, the three Android apps in 2021 and SuperVPN in 2023 share a profile: free to install, vague about their owners, and storing far more than their privacy policies suggested. Free VPNs need money from somewhere, and if it is not your subscription it is often data or bandwidth. Hola's model, which uses free users' devices as exit points for paying business customers, is disclosed in its FAQ; many others are not.

That does not mean every free tier is unsafe. Proton VPN's free plan runs on the same infrastructure and no-logs policy that Securitum audits each year, most recently in May 2026, and it is one of the few free options whose claims have been checked from outside. If you need a free VPN, choose one with that kind of record; Proton VPN is the example we point to, and that link is an affiliate link. Our guide to what a VPN does not protect covers the risks no VPN removes.

Can VPNs be hacked?

Yes, in several ways, and it helps to know which one a headline describes. A provider's server can be compromised, as NordVPN's and TorGuard's were. A provider's own databases can be exposed through poor configuration, as UFO VPN's and SuperVPN's were. A provider can be compelled or choose to hand over what it holds, as with IPVanish and PureVPN. And the tunnel on your device can be bypassed by an attacker on the same network, as TunnelVision showed in 2024, which Leviathan Security Group's own write-up says affects Windows, Linux, iOS and macOS but not Android.

What limits the damage in every case is how little the provider stores. Servers that keep nothing on disk, short-lived keys and no activity logs mean that even a successful break-in finds little of value. That is why independent no-logs audits and the design choices behind them matter more than any single incident; we explain the RAM-only approach in how RAM-only VPN servers work.

How to judge a provider's response

Every provider will eventually have a security problem. What separates them is what happens next. When you read about an incident, look for these five things.

1. Disclosure by the provider itself. NordVPN and Windscribe told users; UFO VPN's exposure was found by researchers, and IPVanish's handover surfaced in court papers.
2. Speed. Windscribe disclosed within two weeks of noticing its servers had gone offline. NordVPN's breach was public about 19 months after it happened, partly by its choice to finish checks first.
3. Specifics. A good statement says what was taken, what it could and could not be used for, and how the provider knows. Vague reassurance is a warning sign.
4. Fixes you can verify. Windscribe replaced its certificate authority and set a date. NordVPN has run regular no-logs assurance engagements since. Look for changes an outsider can check.
5. No repeat. One incident followed by real change is very different from a pattern, such as SuperVPN appearing in two separate exposures.

Edge cases

• Claims are not breaches. Forum posts claiming a hack, like the 1011 claim, need evidence. Wait for the provider's response and independent analysis before acting.
• Owner changes. IPVanish's 2016 handover happened under a previous owner; Ziff Davis bought it in 2019 and it has since published audits. A brand's past is relevant, but so is what changed.
• Your own device. None of these incidents would matter if malware were already on your computer. A VPN does not protect a compromised device.
• Change your password anyway. If a provider you use is breached, change that account's password and any reused ones; it costs nothing.