A VPN Provider Was Hacked, Exposing 865,000 Users Who Thought Nothing Was Being Logged. Here’s What VPNs Actually Do.

Do You Need a VPN: Key Takeaways

• HTTPS now encrypts most traffic, so the classic public-WiFi password theft scenario is far less realistic when you ask do you need a VPN.
• However, HTTPS does not hide DNS lookups or protect against evil-twin networks, so do you need a VPN for those remaining risks.
• A VPN can shield your browsing from your ISP, which since 2017 may sell that data, answering do you need a VPN for home privacy.
• Free VPN apps often contain trackers or malware, making them riskier than no VPN, so verify audits before trusting any provider.

VPN advertising has spent years leaning on a specific fear: that using public WiFi without one leaves you exposed to hackers reading your passwords in real time. That threat was real in the early 2010s. The web has changed enough since then that the honest answer to “do I need a VPN” in 2026 is more nuanced than either the marketing or the dismissive “you don’t need one at all” counter-argument suggests.

What HTTPS Already Handles

The biggest shift undercutting the old VPN pitch: the vast majority of websites now use HTTPS encryption by default, meaning the connection between your browser and the site itself is encrypted regardless of whether a VPN is running. Running into a plain, unencrypted HTTP connection has become genuinely rare, especially for anything involving sensitive information like logins or payment details.

That single change means the specific scenario VPN ads love to depict, someone on the same coffee shop WiFi intercepting your banking password in plain text, is far less realistic than it used to be, since HTTPS already encrypts that traffic content independent of any VPN.

What HTTPS Doesn’t Cover

HTTPS encrypting the content of your traffic doesn’t mean every risk on a public network disappears. HTTPS doesn’t protect DNS queries, the lookups that translate a website name into an address, which can still reveal which sites you’re visiting to anyone else on the same network. It doesn’t protect broader connection metadata either. And critically, HTTPS does nothing to protect you if you connect to a fake network in the first place, an “evil twin” hotspot mimicking a real business’s WiFi name, or a malicious captive portal designed to intercept traffic before HTTPS protections even engage.

Those are the genuine, remaining public WiFi risks worth taking seriously in 2026, distinct from the outdated “any public WiFi is dangerous” framing.

Where a VPN Still Genuinely Helps

Given that picture, a VPN’s real, current value is narrower but still meaningful in specific situations. It hides which specific sites you’re visiting from anyone else on the same network, including the network operator itself, which HTTPS alone doesn’t fully do since DNS lookups can still leak that information. It’s also a genuine layer of protection against the fake-network and malicious-portal risks described above, since a VPN’s encrypted tunnel operates independently of whatever the local network is doing.

For sensitive work tasks handled over an untrusted network, a hotel, an airport lounge, a conference WiFi, a VPN remains a reasonable precaution rather than an unnecessary one.

The Bigger Reason a VPN Might Matter: Your Own ISP

A separate, often overlooked reason people use VPNs has nothing to do with public WiFi at all: since 2017, U.S. internet service providers have been legally permitted to collect and sell customer browsing data, after Congress eliminated FCC privacy rules that would have required opt-in consent for that practice. Comcast, AT&T, Verizon, and other major ISPs all participate in some form of data monetization built on customer browsing history. A VPN routes traffic through its own servers instead, which means your home ISP sees only an encrypted connection to the VPN provider rather than the specific sites you visit.

That’s a genuinely different value proposition than the public-WiFi pitch, protecting against your own everyday internet provider rather than a hypothetical stranger on a coffee shop network, and it’s arguably the more relevant reason for a typical household user to consider a VPN in 2026.

The Catch: You’re Trusting the VPN Provider Instead

Using a VPN doesn’t eliminate the trust question; it just relocates it from your ISP to the VPN company. This is where 2026 has delivered a genuinely cautionary, concrete example: a data breach at SplitVPN, a provider previously operating under a different name, exposed the personal information of roughly 865,000 users, directly undercutting the “no-logs” promise that’s central to most VPN marketing. More broadly, no-logs claims have become one of the most frequently overstated promises in the industry, with documented cases of providers claiming not to log user activity while actually retaining exactly that kind of data.

Choosing a VPN based purely on marketing language, without checking for independent third-party audits of its actual logging practices, means trusting a company’s word over verified evidence, the same blind trust a VPN is often marketed as helping you avoid with your ISP.

Free VPN Apps Deserve Specific Suspicion

If the trust question above applies to any VPN provider, it applies with far more force to free ones, where the research is genuinely alarming rather than mildly cautionary. Independent security research has found that roughly 80% of free VPN services embed tracking features, and over half may sell user data to third parties, the exact behavior a VPN is supposed to protect against in the first place. Separate analysis found that nearly 60% of popular free VPN apps were secretly Chinese-owned and close to 90% had serious privacy flaws, including logging and opaque data-sharing practices.

CSIRO research on Android VPN apps specifically found that 38% contained malware, 75% included third-party trackers, and 18% didn’t actually encrypt traffic at all despite being marketed as VPNs, with a small percentage even enabling man-in-the-middle attacks, the specific threat category a VPN exists to prevent. A separate study of popular free Android VPNs found 17 out of 18 contained at least one embedded tracker, some with more than a dozen trackers from ad and analytics networks across multiple countries, plus permission requests reaching into camera, microphone, contacts, and precise location access that have nothing to do with routing internet traffic.

Running a free VPN in this category isn’t a lower-cost version of the protection a paid VPN offers; the research suggests it’s frequently a worse security posture than using no VPN at all.

What to Actually Check Before Choosing One

A few concrete, verifiable things worth looking for rather than taking a provider’s claims at face value:

• Look for a completed, published independent audit of the no-logs claim, ideally repeated on some regular cadence rather than a single one-time report from years earlier, since practices and ownership can change.
• Check the provider’s jurisdiction and corporate history, since a company that’s changed names or ownership structure, the way SplitVPN previously operated under a different brand, is worth extra scrutiny before trusting it with your traffic.
• Confirm the specific claim being audited matches what’s being marketed, since some audits cover a narrow technical claim while the marketing implies a much broader privacy guarantee than the audit actually verified.
• Weigh whether the specific threat being addressed, ISP data sales versus public WiFi risk versus general privacy, actually matches the reason for considering a VPN in the first place, since the right provider features and the right expectations differ depending on which problem is actually being solved.

The Honest Bottom Line

A VPN in 2026 isn’t the universal shield the marketing implies, and HTTPS has genuinely closed the specific public-WiFi threat that built the VPN industry’s original pitch. But it isn’t useless either: hiding browsing activity from your own ISP, protecting against fake network and malicious portal risks, and adding a layer of privacy for sensitive work on untrusted networks are all real, current reasons to use one.

The bigger shift for 2026 is that choosing a VPN now requires the same skepticism applied to any other privacy claim, verified through independent audits rather than assumed, given how directly the SplitVPN breach undercut exactly the promise most VPN providers lead with.

Sources: Aggregated 2026 VPN and web security reporting from Cybernews, ProtonVPN, and HowToGeek, cross-checked across multiple sources.

Bottom Line

If you do you need a VPN to hide browsing from your ISP or protect against fake networks, choose a provider with a recent independent no-logs audit and a clear jurisdiction. Then test the VPN on a trusted network before relying on it for sensitive tasks.

Related Reading

• A Flaw in One Baby Monitor Platform Exposed Over a Million Cameras. Here’s the Everyday Mistake Behind Most Baby Monitor Hacks.
• Google Reversed Course on Cookies. If You Use Chrome, You’re Still Being Tracked by Default.
• Your Next Monitor Might Show You Ads. Here’s How to Make Sure It Doesn’t.

Further reading: FTC: tips for using VPN apps.

Photo credit: “Laptop Keyboard” by Baddog_, licensed BY (https://creativecommons.org/licenses/by/2.0/). Source: https://www.flickr.com/photos/28523358@N03/2683642114