The company insists this is not a leak but rather accounts that were given away for free and ended up on public forums.
Recently, Damien Bancal, a security researcher with over 30 years of experience, posted a brief news report, alleging that a Swedish VPN provider, Mullvad VPN, leaked user data.
“During an investigation carried out on behalf of a client of the ZATAZ Monitoring service, an astonishing data leak targeting Mullvad was discovered. Dozens of web addresses, leading to the Mullvad API, offered access to user connection information, such as IP addresses [
IPv4 and IPv6 addresses], connection dates and some other information which, fortunately, was not personally identifiable,” the post reads.
Bancal, who’s been following hackers for years now, stumbled upon a hacker discussion and learned about their plans to release some data related to the Mullvad VPN on the dark market. The hackers shared some data that included a 16-digit Mullvad client ID along with their expiration date.
The researcher shared several different links to caches of forums where threat actors apparently were trading off dozens of Mullvad VPN accounts. It seems that not a lot of information on those accounts can be exposed with just an ID number, as no names, email addresses or other personally identifiable information can be retrieved.