Actor claims leak of 420,000 user records from Paper VPN
A threat actor has posted a free download on an underground forum claiming it holds about 420,000 user records from Paper VPN, a VPN service marketed to journalists and activists in restricted regions. The claim includes usernames, email addresses, full names, passwords and activation keys, with a breach date of October 2026; Paper VPN has not confirmed an incident. Users should change passwords, especially if reused elsewhere, and watch for targeted phishing.
What happened
A threat actor has posted a free download on an underground forum claiming it holds about 420,000 user records from Paper VPN, a VPN marketed to journalists and activists in restricted regions. The claim includes names, emails, passwords and activation keys, with a breach date of October 2026. Paper VPN has not confirmed an incident.
Why it matters
If confirmed, the leak exposes the identities of people using the VPN to bypass censorship, which could unmask journalists and activists. Leaked passwords and activation keys open the door to account access elsewhere and to targeted phishing.
What to do
Check whether anyone in the company uses Paper VPN; users should change their password now, especially if reused on other services, and treat activation keys as compromised. Watch for official provider statements and for phishing aimed at affected users.
For the technical team
- Affected
- Paper VPN, serviço comercial de VPN voltado a jornalistas e ativistas em regiões com restrições; base alegada de cerca d · Paper VPN, a commercial VPN service marketed to journalists and activists in restricted regions; no versions cited. Claimed base: about 420,000 user records.
- Exploitation
- Threat-actor claim posted as a free download on an underground forum, reported by DailyDarkWeb. Paper VPN has not confirmed an incident; unverified claim.
- Fix
- No fix applicable, as this is a data leak. Mitigation cited by the source: change passwords, especially if reused elsewhere, and watch for targeted phishing; claimed data includes passwords and activation keys, to be treated as compromised.
- Vector
- Intrusion method not described in the sources. The actor cites an October 2026 breach date and frames the leak as protest over the provider's data collection.
- More details
- DailyDarkWeb classifies the case as an unverified threat-actor claim, not confirmation of a breach. Analyst note: for a privacy tool, names and emails tied to a VPN account could help unmask people who use it to get around censorship.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
