VPNInfobaseAcross the 22 services on our register (including two now closed or rebranded) we found eleven dated incidents since 2016. Two involve US federal investigators using records that, according to press reports of court documents, came from a VPN provider: IPVanish in 2016 and PureVPN in 2017. In three others, authorities searched or seized equipment and the provider says no user data was found. Every entry below links to the source, and where the provider gave its side, that is marked as the provider’s account.
The timeline
| Date | Provider | What happened | Type | Source |
|---|---|---|---|---|
| May to June 2016 | IPVanish | According to TorrentFreak’s reading of court documents, after a first summons the then-owner replied that it did not log usage information; following a second summons dated 9 June 2016 it gave US Homeland Security Investigations a subscriber’s account details, real IP address and connection times relating to an IRC session. The service was then owned by a different company than today’s. Reported 5 June 2018; the same article quotes StackPath, the operator since 2017, saying IPVanish does not log or store users’ logs | Records supplied | TorrentFreak |
| August 2017 | Hotspot Shield | The Center for Democracy and Technology filed an FTC complaint on 7 August 2017 alleging undisclosed data sharing with ad networks and traffic redirection in the free VPN. A complaint, not a finding | Complaint | CDT |
| October 2017 | PureVPN | According to The Register’s report of an FBI criminal complaint, PureVPN was able to determine that its service was accessed by the same customer from two originating IP addresses. The article does not say how the FBI obtained the records or include a PureVPN response. Reported 8 October 2017 | Records supplied | The Register |
| October 2019 | NordVPN | NordVPN disclosed that a third-party datacenter server in Finland had been accessed in 2018 and that an expired TLS key was exposed. NordVPN’s account: its network and user data were not affected | Infrastructure breach | NordVPN |
| June to July 2021 | Windscribe | Ukrainian authorities seized two servers (Windscribe disclosed this on 7 July 2021). Windscribe says the servers held no user logs but an OpenVPN certificate key was exposed, because the servers were not encrypted at rest; it then moved to RAM-only servers | Server seizure | Windscribe |
| September 2021 | ExpressVPN | ExpressVPN published a response to news reports about an executive’s earlier work on Project Raven, saying it does not condone Project Raven. Not a breach of ExpressVPN systems | Governance | ExpressVPN |
| April 2023 | Mullvad | Swedish police came to Mullvad’s Gothenburg office with a search warrant to seize customer data. Mullvad says none existed and police left without taking anything | Search warrant | Mullvad |
| September 2023 | Atlas VPN | A Linux client (v1.0.3) exposed an unauthenticated local API that let a malicious website disconnect the VPN and reveal the user’s real IP. Fixed in v1.1 per Help Net Security. Atlas VPN closed in April 2024 | Vulnerability | Help Net Security |
| April 2025 | Windscribe | A Greek court dismissed a case against Windscribe’s co-founder tied to a Finland server, on 11 April 2025, because Windscribe had no user data to provide (Windscribe’s account) | Court case | Windscribe |
| February 2026 | Windscribe | Dutch authorities physically took a server. Windscribe says it ran RAM-only and held no data | Server seizure | Windscribe |
| August 2026 | IVPN | An attacker exploited a BTCPay Server vulnerability on IVPN’s Bitcoin payment server on 7 August 2026 and took 0.6168 BTC of IVPN’s operating funds. IVPN says the customer database, accounts and VPN infrastructure were on separate systems and not touched | Payment-server breach | IVPN |
What the entries show
- Records supplied: both cases are US federal investigations reported from court documents, and both involve connection or account data as described by the reporters, not browsing content. Each is one outlet’s account; neither provider’s side is quoted here.
- Seizures and searches: three entries (Windscribe in Ukraine and the Netherlands, Mullvad in Sweden) are provider accounts of what authorities found. These are provider statements; we have not seen the authorities’ side, and the Ukraine entry involved an exposed key.
- Vulnerabilities and breaches: the Atlas VPN, NordVPN and IVPN entries are security failures, and none is a case where the provider says user browsing data leaked.
What this page does not do
It is not exhaustive. We searched the register providers and the sources above; incidents we did not find, or that happened at providers not on the register, are missing. The absence of an entry is not evidence that nothing happened. Where a provider’s own post is the only source we say “the provider’s account”. To add or correct an entry, write through the contact page.
Method
Researched from court-reporting outlets, security press and the providers’ own incident posts, each read on the date shown in the sources list; the NordVPN and Hotspot Shield entries rest on register records checked on 28 September 2026 because those sites blocked automated reads. Nothing was tested by us. Each provider’s full record is in the VPN audit register. For what audits did and did not cover, see the audit tracker; for who runs each service, who owns your VPN; for how to read a no-logs claim, what a no-logs policy proves.