SuperVPN & GeckoVPN Data Breach (2021): What Was Exposed & What To Do

In February 2021, records from SuperVPN and GeckoVPN were exposed in a single dataset that also contained a small number of entries from FlashVPN. The incident, reported on 25 February 2021, involved 20.3 million records containing device information, device serial numbers, email addresses, geographic locations, IMSI numbers and login histories. The presence of data from multiple brands in one file indicates that the services may have operated on a shared platform.

Breaking down the breach

The records became public in a single file that combined data from the named services. Reported details state that the file included email addresses together with the country from which each login occurred and the date and time of those logins. Device fields listed the make and model of the handset or router, its IMSI number and its serial number. No information has been released on how the file was obtained or on the exact date range of the logins it contained.

How a breach like this happens

Services that maintain large volumes of authentication and device data can lose control of that data through unauthorised access to storage systems or through misconfigured repositories that allow public retrieval. When multiple brands share the same backend infrastructure, a single point of exposure can surface records belonging to all of them at once. The method used in any specific case remains undisclosed unless the operators publish a technical report or an independent investigation releases findings.

SuperVPN & GeckoVPN and its sector

SuperVPN and GeckoVPN are among the consumer virtual-private-network applications that market themselves as free or low-cost options for encrypting internet traffic and masking IP addresses. Providers in this sector routinely collect account identifiers, connection timestamps and device identifiers to manage sessions and enforce usage limits. Because these services handle traffic from many users who may not review privacy policies in detail, the datasets they hold can include both account details and technical information that links a person to specific devices and locations.

What was likely exposed

The published facts list the exposed fields as device information, device serial numbers, email addresses, geographic locations, IMSI numbers and login histories. These categories correspond to the contents described in the February 2021 file. No further categories have been confirmed, and the operators have not released an inventory of every field present in the dataset.

What's at stake

Email addresses combined with login timestamps and device identifiers can be used to map an individual’s online activity over time and to target further attempts at account access. IMSI and serial numbers can assist in linking a record to a specific handset, which may be relevant in investigations or in attempts to profile a user across services. The organisation faces the operational task of securing the affected systems and notifying users whose records appeared in the file.

Were you affected?

Individuals who used SuperVPN or GeckoVPN can check whether their email address appears in known breach datasets by running a free exposure scan through a reputable service that aggregates public breach records. Changing passwords for any associated accounts and reviewing connected devices for unfamiliar activity are standard first steps when email addresses and device identifiers have been exposed.

AICompiled with AI assistance from public sources and published under our editorial standards.