The Russian VPN service SplitVPN (formerly NotVPN) suffered a data breach in July 2026, exposing 865,336 unique email addresses. The incident also compromised IP addresses, user country information, and partial payment card data (first 6 and last 4 digits, plus expiry date). This breach underscores the risks associated with VPN services, particularly those operating in jurisdictions with less stringent data protection, and the importance of strong credential hygiene.