ActMobile VPN Service Exposes 1.58 M Email Addresses and IPs in Unverified Breach
What Happened — In October 2021 a researcher uncovered an exposed database attributed to ActMobile, the operator of Dash VPN and FreeVPN. The dump contained roughly 1.6 million unique email addresses, IP addresses and password hashes, which were later posted on a hacking forum. ActMobile has denied that the data originated from its services, and the breach remains flagged as “unverified.”
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of inadequate data‑handling controls in third‑party services, a scenario continuous control‑assurance programs are built to detect and document.
- Demonstrable vendor‑risk oversight (evidence of security questionnaires, continuous monitoring, and audit‑ready artifacts) helps prove due diligence to regulators and partners.
- Logging and access‑control evidence around database exposure can provide a defensible audit trail if similar claims arise.
Who Is Affected — VPN and privacy‑focused SaaS providers; their customers whose credentials were exposed.
Recommended Actions
- Initiate a third‑party risk review of any VPN or remote‑access services you consume.
- Verify that providers enforce strong encryption at rest, strict access‑control policies, and regular security‑posture monitoring.
- Rotate any passwords that may have been reused and monitor for credential‑stuffing activity.
- Document the due‑diligence process to satisfy audit requirements. Source: https://haveibeenpwned.com/api/v3/breach/ActMobile
Technical Notes — The exposure appears to stem from a misconfigured database that was publicly reachable. No specific CVE is associated; the data included email addresses, IP addresses and salted password hashes. Source: https://haveibeenpwned.com/api/v3/breach/ActMobile