A total of seven VPNs that claim “no log” policy on their websites have exposed user data amounting to 1.2 TB, according to a report from Comparitech and further investigation from vpnMentor.
According to the initial report, China-based UFO VPN leaked close to 894GB of data, despite having a no-logging policy. The exposed data includes passwords, IP addresses, VPN session tokens, the operating system used, and more. The free VPN app has over 10 million downloads on the Google Play Store. Comparitech found data logs in an unsecured Elasticsearch cluster and said over 20 million data entries were being added every day.
VpnMentor later discovered that six more VPNs shared the infrastructure and database with UFO VPNs, bringing the total exposed data to 1.2TB. All of these have downloads ranging from 100,000 to a million and have mentioned zero log policy on their respective websites. These so-called free VPNs are —
Despite Comparitech informing UFO VPN first, it didn’t secure the data until vpnMentor’s team reached out and that was at least 18 days later. Interestingly, the UFO VPN team claims that they were unable to secure the data due to the Coronavirus.
UFO VPN also said that the VPN service keeps “anonymized” data logs for traffic monitoring, despite knowing that the leaked data contains IP addresses, passwords, and more. In fact, the research team from vpnMentor said some records even had home addresses, payment information, device information, etc.
All seven VPNs have the same payment provider Dreamfii HK Limited and few even have similar UI on their websites ..
Support the originator by clicking the read the rest link below.
