SuperVPN & GeckoVPN Breach Exposes Over 20 Million User Accounts
What Happened
In February 2021, the free VPN services SuperVPN and GeckoVPN were compromised, resulting in the exposure of 20,339,937 user records. The leaked dataset combined information from both brands (and a few records from FlashVPN), indicating a shared backend platform.
Why It Matters for Compliance & Audit Readiness
- Highlights the risk of insufficient vendor‑side data segregation; a continuous control‑assurance program should capture shared‑infrastructure dependencies and document them.
- Underscores the need for verifiable encryption‑at‑rest and robust access‑logging for third‑party services that process personally identifiable information (PII).
- Reinforces the importance of maintaining an up‑to‑date vendor risk register and periodic attestations to NIST CSF Identify‑Govern‑Risk‑Assess (ID.GV‑1) controls.
Who Is Affected
- Consumers of free VPN services (individual remote workers, privacy‑focused users)
- Organizations that permit VPN use on corporate devices (enterprise remote‑access programs)
- Telecommunications entities whose subscriber IMSI numbers were disclosed
Recommended Actions
- Review all VPN and remote‑access vendor contracts for data‑handling clauses and shared‑infrastructure disclosures.
- Validate that logging, encryption, and access‑control monitoring are in place for any third‑party VPN solution.
- Request a formal incident‑response report from the provider and update your breach‑notification playbook accordingly.
Technical Notes
- Attack vector: Unauthorized access to a centralized user‑data repository serving multiple VPN brands.
- CVEs: None publicly disclosed.
- Data types exposed: Email addresses, geographic location, login timestamps, device make/model, device serial numbers, IMSI numbers.
Source: https://haveibeenpwned.com/api/v3/breach/SuperVPNGeckoVPN