Gig Economy, VPN & Subs · VPN · Private litigation + Data breach
NordVPN (Nord Security)
Headline
The 2026 breach claim is unverified and should stay that way in any published writeup until corroborated - an attacker's assertion is a lead, not a finding, consistent with how the Liberty Mutual and MetLife claims are…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The 2026 breach claim is unverified and should stay that way in any published writeup until corroborated - an attacker's assertion is a lead, not a finding, consistent with how the Liberty Mutual and MetLife claims are handled elsewhere in this tracker. The structural point for the whole VPN category is more useful than any single claim: a VPN does not eliminate the observer, it relocates them from your ISP to the VPN operator, and a no-logs policy describes what a company retains by default rather than what a court can compel it to begin collecting. Cross-ref the Proton Mail row in Email Providers, where exactly that compulsion occurred.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; no sources are on file yet, so no legal tier is assigned.
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
DIRECTLY REGIONAL LAWSUIT (current status not verified as of Oct 2026; filed April 2026 in the Eastern District of Virginia, alongside a parallel suit in the District of Connecticut, per Law360): accuses Nord Security of 'unlawful, unfair, and deceptive' AUTO-RENEWAL pricing practices, alleging the company makes it 'intentionally' and 'exceedingly difficult' for customers to cancel — the proposed class definitions in the April 2026 Virginia and Connecticut suits were not verified this pass (an earlier Illinois suit, Sasgen v. NordVPN, targeted Nord's internet privacy and security products; Nord offers NordVPN, NordPass and NordLocker). In response to an earlier, similar class action (S.D.N.Y.), NordVPN stated: 'we are and always have been very clear about the recurring nature of our services,' and one commentator described the plaintiff firm's pattern of VPN investigations as possible 'lawsuit fishing' rather than confirmed wrongdoing.
Data sharing
UNVERIFIED 2026 BREACH CLAIM: a threat actor claimed to have accessed NordVPN development tools/Salesforce API keys; NordVPN DENIED any real breach occurred, stating attackers only reached a THIRD-PARTY TEST ENVIRONMENT containing DUMMY DATA that never connected to production systems or actual customer information — a disputed claim, not a confirmed breach, similar to the Wizz Air pattern documented elsewhere in this tracker. SEPARATELY, Nord Security and Surfshark merged in 2022 yet still market NordVPN and Surfshark as separate, competing services; an infrastructure analysis has reportedly attributed a majority of analyzed VPN network capacity to the combined group, and Nord Security has been alleged to have ownership ties to the review site Cybernews — claims not independently verified, but relevant to how much weight to give VPN 'independent reviews.'
Fees and billing
Auto-renewal cancellation friction is common across the WHOLE VPN industry (per multiple sources), not unique to NordVPN — Mullvad VPN is cited as an exception that has reportedly eliminated recurring subscriptions.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy nordvpn.com/privacy-policy/ | Not fetched yet | NO (HTML only) |
| Terms of service nordvpn.com/terms-of-service/ | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.