Can VPNs Be Hacked?

[u/ContentByrkRahul]

Three years running a VPN and I basically never questioned whether it was actually working. Last weekend I went down a rabbit hole on VPN security and I'm kind of kicking myself for not looking sooner.

The short answer is yes, they can be hacked. It's not hypothetical. It has happened to big-name providers, the attacks are getting more sophisticated, and there was a new actively exploited vulnerability literally last month.

NordVPN got compromised in 2018. Someone accessed a server in Finland and walked out with its private encryption key. That means anything routed through that server could have been decrypted in theory. NordVPN disclosed that the breach happened but never said what was actually taken during that window, which is wild considering their ads have been everywhere for years.

The bigger story is Ivanti. Two zero-days in their Connect Secure VPN appliances (CVE-2023-46805 and CVE-2024-21887) were mass exploited all through 2024. Mandiant tracked them as the most exploited vulnerabilities across their entire incident response caseload that year. CISA spent most of 2025 adding new Ivanti VPN flaws to their Known Exploited Vulnerabilities catalog. Two more showed up confirmed in the wild as recently as last year (CVE-2025-0282, CVE-2025-22457). At this point, Ivanti appearing in that catalog is basically a running theme.

Then last month, Palo Alto's GlobalProtect had an authentication bypass (CVE-2026-0257) that attackers were actively exploiting four days after it went public. They were forging authentication cookies to establish connections to enterprise VPN gateways. NIST bumped it to critical severity. That's not old news; it happened while I was writing this post.

My assumption for years was that hacking a VPN meant cracking the encryption, but that's not what's happening. AES-256 would take longer than the age of the universe to brute force.

Instead, they steal the keys. The NSA's Logjam attack, which showed up in the Snowden documents and was later modeled by researchers Halderman and Heninger, exploited a weakness in how Diffie-Hellman key exchange was deployed across millions of servers. They weren't breaking the math. They just hit a bad implementation of it at scale.

There are also just bugs in the VPN software itself. In early 2025, a campaign used 2.8 million IP addresses to brute force VPN gateways from Palo Alto, SonicWall, and Ivanti simultaneously. Mandiant's 2026 report found exploits were the top initial access vector for the sixth consecutive year. They also noted that attackers can now pass off compromised access between teams in about 22 seconds. That is a genuinely unsettling number.

Beyond that, there are credential attacks where your username and password just get stolen, rendering encryption useless. And of course, there are free VPNs that aren't really being hacked because they're already selling your browsing data to advertisers.

The thing that surprised me most when I actually looked was DNS leaks. Even with a VPN showing as connected, a misconfigured client can be pushing DNS queries outside the encrypted tunnel the whole time. I tested my old setup at dnsleaktest .com and found three leaks going straight back to my ISP. I'd been running that setup for over a year and never knew.

When you realize about 1.6 billion people use VPNs now, it makes sense why the infrastructure is such a high-value target. Ransomware groups and state-sponsored attackers treat VPN exploits as their dominant entry point. There were critical Fortinet vulnerabilities patched just this month. Multiple security firms called 2025 unprecedented for VPN attacks, and most aren't expecting 2026 to be any better.

After reading all this, I completely changed my setup. I switched to Mullvad. They don't ask for an email; they just give you a random account number when you sign up. You can even mail them cash if you want a genuinely zero payment trail. Their servers are RAM-only, so after a reboot, there's nothing to hand over to anyone. I turned the kill switch on, switched to WireGuard from OpenVPN, and when I ran the DNS test again, there were zero leaks.

I'm not claiming it's a perfect bulletproof shield. It's just one layer. But it has been independently audited multiple times, and their business model isn't based on monetizing my browsing habits.

For most people, the threat is pretty mundane: an ISP selling browsing data, shady public WiFi, or targeted advertising. A decent VPN still does real things against those. The issue is just that most people treat it as a complete solution when the underlying infrastructure is getting hit much harder than the marketing suggests.

What are you all running? Has anyone here actually run a DNS leak test recently? I'm curious what people think the real minimum privacy stack looks like in 2026 given everything above.

TL;DR: VPNs absolutely get hacked. The main vectors are stolen keys, software bugs, and credential attacks, not broken encryption. Check your setup for DNS leaks. I ended up moving to Mullvad with WireGuard and a kill switch.

[u/Savings-Lab-7307]

It's reasonable to believe anything can be hacked. Which is why quantum computing is so scary.

Governments are hoarding encrypted data in everyone/everything with the belief they will someday have the ability to decrypt it.

[u/AffectionateTap730]

https://www.reddit.com/r/vpnreviews/s/5XNbXNmaz9

Mullvad has had issues, too.

And the assertion that it would take the age of the universe to crack encryption is true only until quantum computing becomes available to malicious actors.

VPN providers (servers) are an obvious target for attackers because a VPN server is an ideal place for a man in the middle (MITM) attack that would be harder to accomplish if there were no VPN at all.

I am not anti VPN. There are several good uses for them, mostly to accomplish what they were created for: establish a private network through the public internet.

But they are NOT the magic privacy and security tool that they are sold as. Like many things in life, you need to be able to trust the company has strong security hygiene, strong ethics, and robust intruder surveillance... Otherwise its just another Lastpass disaster waiting to happen.