The Silent Breach: When Your VPN Vendor Knows First — and You Find Out Last

A Chain of Trust With a Broken Link

Accounting firms are conditioned to think about breach notification. Most states impose deadlines. The FTC's Safeguards Rule requires qualified firms to respond on a clock. But there's a quiet assumption baked into all of that compliance work: that you'll find out a breach happened in the first place.

When the breached party is your own firm, that assumption holds. When it's your VPN vendor — a third party sitting in the middle of your remote-work traffic — the assumption collapses. Your firm may not be the vendor's customer in any meaningful legal sense if you signed up through a reseller or a sole practitioner's personal plan. Even when you are, most consumer and small-business VPN contracts contain no obligation to notify you of a security incident at all.

What Past VPN Breaches Actually Looked Like

The VPN industry has a documented history of incidents, and the disclosure record is instructive.

In 2021, a series of server intrusions across multiple VPN providers came to light largely because of security researchers and journalists, not because the vendors proactively informed customers. Some providers confirmed compromises only after being contacted. Others acknowledged incidents months after the fact, in blog posts timed to coincide with infrastructure upgrades.

The 2021 Mullvad disclosure stands as a rare counterexample: the Swedish provider reported that one of its servers was breached by an attacker attempting to inject malware, and it published details promptly — while noting the machine held no user data because of the company's architecture. That's what good disclosure looks like, and it remains the exception rather than the rule.

The pattern across most incidents: discovery by outsiders, disclosure by press release, and no individual notification whatsoever. If your firm was routing client tax documents through one of those tunnels at the time, you would likely never have known.

Why Notification Law Doesn't Reach You

US breach notification is a patchwork of state statutes, and nearly all of them are triggered by personal information — names paired with Social Security numbers, financial account data, and similar. A VPN operator typically doesn't hold that data about your clients. It holds IP addresses, connection timestamps, maybe a billing email. If the vendor's definition of personal information excludes what was stolen, no state statute compels them to notify anyone, including you.

Your firm's own obligations don't fill the gap either. The Safeguards Rule and state accountancy board expectations govern how your firm responds to incidents affecting client data, but they don't give you visibility into your vendors' incidents. And a generic data-processing agreement, if one exists at all, rarely specifies incident notification timelines for a service the vendor classifies as a connectivity tool rather than a data processor.

The result is a structural blind spot: the party with the earliest knowledge of the incident has the fewest obligations to the parties with the most to lose.

The Questions to Ask Before You Sign

Firms perform vendor due diligence on tax software, document management platforms, and cloud storage. VPN selection deserves the same scrutiny. Before signing with any provider, put these questions in writing:

• What is your contractual notification commitment? Ask for a specific timeframe — 72 hours is a reasonable benchmark, mirroring GDPR-style expectations even for US vendors.
• What data do you actually hold about our connections? The answer should be short. Vendors that can't articulate their data footprint can't credibly assess breach impact.
• Have you experienced a security incident in the past five years, and how did you disclose it? The response tells you as much about culture as history. Evasion here predicts evasion later.
• Do you hold any third-party security audits or attestations, and will you share them under NDA? Independent verification — SOC 2 reporting, published no-log audits — matters more than marketing language.
• Who is our point of contact during an incident? An email address that routes to a ticketing queue is not an answer.
• Under what circumstances would you notify us if a server we use is compromised but no customer data is taken? The best vendors treat infrastructure incidents as reportable events regardless of data exposure.

Treat Disclosure Behavior as a Rating Factor

At AccountingVPN, we've started weighting a vendor's breach-disclosure track record as heavily as its encryption standards. A provider with strong cryptography and a history of silence after incidents is a riskier proposition than a provider with a modest feature set and a documented history of prompt, candid disclosure.

The uncomfortable truth is that when your VPN vendor gets breached, the notification chain runs from the vendor to the press to you — if it runs at all. The only reliable way to shorten that chain is to demand, contractually, that it include you from the start.