ExpressVPN
ExpressVPN is a virtual private network service that encrypts internet traffic and masks users' IP addresses to provide privacy and security online. The subscription-based service offers apps for multiple platforms and was acquired by Kape Technologies in 2021.
Score generated by AI agents based on publicly cited evidence and reviewed by the project maintainer. Not independently validated. Last assessed 2026-09-27. Score revised 2026-09-27: 57 → 41.
Score History
Timeline events are AI-curated from public reporting. Score trajectory is derived from documented events.
Peter Burchhardt and Dan Pomerantz founded ExpressVPN in 2009 as a plain subscription VPN and later reincorporated it in the British Virgin Islands. Nobody outside the company verified its no-logs claims until the December 2017 seizure of a Turkish server, which turned up no user data. The company was independent throughout. Crossrider, its future owner, was during these years a separate business linked to adware.
The April 2019 launch of TrustedServer RAM-only servers began ExpressVPN's most trusted period. PwC audited its no-logs policy in July 2019, the company co-founded the VPN Trust Initiative, and it launched the Lightway protocol in 2020 and open-sourced it in 2021. In the same period it hired Daniel Gericke as CIO while knowing 'key facts' of his Project Raven past, and Kape kept buying rival VPNs and, in March 2021, VPN review sites.
Kape announced its $936 million purchase of ExpressVPN on September 13, 2021. A day later the DOJ fined CIO Gericke $335,000 over Project Raven. Staff protested, Edward Snowden urged users to leave, and ExpressVPN became one of four VPNs and two review sites under a single owner. Product work carried on (Keys, the Aircove router, a $100K server bug bounty), but a DNS leak bug shipped unnoticed in May 2022.
When Kape delisted on May 31, 2023, ExpressVPN became part of a wholly private company owned by Teddy Sagi's Unikmind. Kape cut about 180 staff in July, founder Burchhardt and CTO Gericke left, and ExpressVPN had a second layoff in March 2025. Its reputation took hits from the DNS leak disclosed in February 2024, Tom's Guide's demotion in March 2024 and an RDP IP leak in 2025. Two auto-renewal class actions were filed in mid-2025.
On September 2, 2025 ExpressVPN replaced its single plan with Basic, Advanced and Pro tiers. In 2026 it spun out ExpressKeys, ExpressMailGuard, Identity Defender and ExpressAI as separate apps, with access set by tier. Entry prices fell and the audit count reached 27, while router users faced confusing support changes and Aircove was retired in favor of a GL.iNet-built router. The California auto-renewal suit moved to a class settlement awaiting approval, and the Illinois suit is on appeal.
Alternatives
The privacy purist's VPN — accepts cash and cryptocurrency, assigns random account numbers instead of email addresses, and has never had a successful data request from law enforcement. €5/month flat with no discounts to push long subscriptions. Easy switch. Smaller server network than ExpressVPN but better privacy posture.
Swiss-based, open-source VPN operated by the same company behind ProtonMail, with a no-logs policy verified by independent audits and a free tier that doesn't require a credit card. An alternative for users uneasy about ExpressVPN's ownership by Teddy Sagi's Kape group. Easy switch: apps available on all major platforms.
Dimensional Breakdown
Summaries below were written by AI agents based on the cited evidence. They are editorial interpretations, not independent research findings.
Dimension History
Timeline (59 events)
ExpressVPN Founded by Burchhardt and Pomerantz
Peter Burchhardt and Dan Pomerantz, Wharton School alumni, founded ExpressVPN as a consumer VPN service initially incorporated in Florida. The company focused on providing encrypted internet connections and IP masking for privacy-conscious users.
Crossrider Founded as Browser Extension Platform
Koby Menachemi and Shmueli Ahdut founded Crossrider in Tel Aviv as a cross-browser extension development platform. The SDK enabled developers to build, distribute, and monetize browser add-ons at scale, with monetization options that facilitated ad injection.
Teddy Sagi Acquires Crossrider for $37 Million
Israeli billionaire Teddy Sagi, who was convicted of fraud and bribery in Israel in 1996, acquired Crossrider for $37 million in December 2012, about 20 months after its April 2011 founding. Sagi's criminal record and involvement in gambling technology (Playtech) raised governance concerns that would later become relevant to ExpressVPN.
Crossrider IPO Raises $75M on London AIM Exchange
Crossrider raised $75 million in its IPO on London's AIM Stock Exchange at a valuation of $250 million. After the offering, Teddy Sagi retained a 56% controlling stake. The IPO was led by Shore Capital and provided the funding base for Crossrider's later VPN acquisition spree.
ExpressVPN Reincorporates in British Virgin Islands
ExpressVPN moved its legal incorporation from Florida to the British Virgin Islands, citing privacy advantages. The BVI has no data retention laws and is not party to international surveillance alliances. While providing genuine privacy benefits, this also places the company beyond the regulatory reach of most consumer protection agencies.
Google-Berkeley Study Names Crossrider as Major Ad Injector Affiliate
A joint study by the University of California, Berkeley and Google identified Crossrider among approximately 1,000 businesses enabling unwanted ad injection into users' browsers. The study found over 50,000 browser extensions and 34,000 software applications that hijacked browsers to inject ads, with nearly 30% being outright malicious, including credential theft.
Crossrider Shuts Down Adware Platform After Rising Abuse
Crossrider officially shut down its browser extension development platform after failing to control its misuse by malware and adware developers. The platform's openness made it impossible to effectively combat abuse. Malwarebytes, Microsoft, Trend Micro, and other security firms had flagged Crossrider extensions as PUP (Potentially Unwanted Programs) and adware.
Crossrider Acquires CyberGhost VPN for €9.2 Million
Crossrider acquired Romanian VPN provider CyberGhost for €9.2 million (including an earn-out), marking its first VPN acquisition and a decisive pivot from ad-tech to recurring-revenue consumer privacy products. This initiated the consolidation strategy that would eventually bring ExpressVPN under the same corporate umbrella.
Apple Removes ExpressVPN from China App Store
Apple notified ExpressVPN that its iOS app was removed from the China App Store following new Chinese regulations requiring government approval for VPN operations. All major VPN apps were removed simultaneously. ExpressVPN publicly criticized Apple for 'aiding China's censorship efforts,' calling it the most drastic measure the Chinese government had taken to block VPN use.
ExpressVPN Server Seized in Turkey Found to Hold No User Data
Comparitech reported that Turkish investigators had seized an ExpressVPN server in January 2017 in the investigation of Russian Ambassador Andrei Karlov's assassination in Ankara; someone had used an ExpressVPN connection to delete the assassin's Gmail and Facebook accounts. The seized server yielded no useful user data, which was taken as real-world validation of ExpressVPN's no-logs policy.
Crossrider Rebrands as Kape Technologies
Crossrider officially changed its name to Kape Technologies PLC and began trading under the KAPE ticker on the London Stock Exchange. The company acknowledged the rebrand was necessary due to 'the strong association to the past activities of the company' — its adware and browser hijacking origins. The name change accompanied a strategic pivot to consumer privacy and security products.
Kape Acquires ZenMate VPN for €4.8 Million
Kape Technologies acquired ZenMate, a Berlin-based VPN provider with 50,000 premium customers, for €4.8 million ($5.5M). This was Kape's second VPN acquisition after CyberGhost, continuing the industry consolidation pattern that would eventually absorb ExpressVPN.
Reuters Exposes Project Raven UAE Hacking Operation
Reuters published a major investigation revealing Project Raven, a secretive UAE government program that used former NSA employees to hack espionage targets including journalists, politicians, activists, and Americans. Daniel Gericke, who would later become ExpressVPN's CIO, was among the operatives who worked for DarkMatter as part of this program between 2016 and 2019.
ExpressVPN Launches TrustedServer RAM-Only Technology
ExpressVPN introduced TrustedServer technology, becoming the first major VPN to operate entirely on RAM-only infrastructure. Servers run only on volatile memory, ensuring all data is wiped on every reboot. Each server loads a fresh software stack from a read-only image on boot, guaranteeing consistent and up-to-date code across the network.
PwC Publishes First Independent Audit of ExpressVPN No-Logs Policy
PwC Switzerland conducted the first independent third-party audit of ExpressVPN's privacy policy compliance and TrustedServer technology. The audit confirmed compliance with ExpressVPN's published no-logs policy under the International Standard on Assurance Engagements (ISAE) 3000, establishing an audit program that would eventually reach 23 independent assessments.
Kape Acquires Private Internet Access for $127.6 Million
Kape Technologies purchased Private Internet Access (PIA) for a total enterprise value of $127.6 million, including $52.9 million cash, 42.7 million new Kape shares, and $32.1 million in debt payoff. This was Kape's third VPN acquisition, doubling its paying subscriber base to over 2 million and aggressively expanding its North American footprint.
ExpressVPN Co-Founds VPN Trust Initiative
ExpressVPN became a founding member of the VPN Trust Initiative (VTI) alongside NordVPN, Surfshark, VyprVPN, and IPVanish. The industry group was established through the i2Coalition to promote best practices and consumer safety standards for VPN providers, representing a voluntary self-regulation effort in a largely unregulated market.
ExpressVPN Launches Lightway VPN Protocol in Beta
ExpressVPN released its proprietary Lightway protocol in beta, designed to improve connectivity speeds and reduce power consumption compared to OpenVPN. The protocol uses the wolfSSL library and comprises only about 2,000 lines of code, making it significantly lighter than alternatives while supporting both TCP and UDP connections.
ExpressVPN Launches Bug Bounty Program on Bugcrowd
ExpressVPN moved its long-running bug bounty program to Bugcrowd, offering $2,100–$2,500 for critical vulnerabilities, $1,000–$1,250 for high-risk issues and smaller rewards for medium and low-severity bugs. All ExpressVPN properties, including apps, browser extensions, APIs, servers and website, were in scope.
Kape Acquires Webselenese (vpnMentor, Wizcase) for $149.1 Million
Kape Technologies acquired Webselenese, the parent company of VPN review sites vpnMentor and Wizcase, for $149.1 million. The sites collectively reached over 105 million readers globally in 2020. This acquisition gave the VPN vendor direct control over ostensibly independent review channels that millions of consumers use to evaluate VPN products.
vpnMentor and Wizcase Shift Rankings to Favor Kape-Owned VPNs
After Kape bought vpnMentor and Wizcase in March 2021, the sites dropped NordVPN and Surfshark from their top recommendations and moved Kape's CyberGhost and Private Internet Access up to the #2 and #3 spots behind ExpressVPN, which already held #1. Once Kape agreed to buy ExpressVPN in September 2021, all three top spots belonged to Kape-owned VPNs. Kape's ownership was disclosed only in a small 'Ownership' link; Pixel Envy noted in October 2021 that the word 'Kape' appeared nowhere in the sites' on-page text.
ExpressVPN Open-Sources Lightway Protocol on GitHub
ExpressVPN released the full source code of its Lightway protocol on GitHub under the GPL v2 license, accompanied by an independent security audit by Cure53. The audit found 14 issues (none critical), all of which were addressed. The open-sourcing allowed community contributions and invited other VPN providers to use the protocol.
Kape Technologies Announces $936 Million Acquisition of ExpressVPN
Kape Technologies announced the acquisition of ExpressVPN for $936 million, the highest sum ever paid for a VPN business. This made ExpressVPN the fourth VPN brand under Kape's ownership alongside CyberGhost, ZenMate, and PIA. The deal consolidated a significant portion of the consumer VPN market under a single entity controlled by convicted fraudster Teddy Sagi.
DOJ Fines ExpressVPN CIO $335K for Project Raven Hacking
The U.S. Department of Justice announced that Daniel Gericke, ExpressVPN's Chief Information Officer, agreed to pay a $335,000 fine and entered a Deferred Prosecution Agreement for his role in Project Raven, the UAE's covert hacking operation. Gericke and two other former U.S. intelligence operatives admitted to violating International Traffic in Arms Regulations while working for DarkMatter.
ExpressVPN Admits Knowing 'Key Facts' About Gericke's Spy Background
Vice/Motherboard reported that ExpressVPN acknowledged knowing 'key facts' about Daniel Gericke's involvement in Project Raven before hiring him. The company stated his history and expertise 'made him an invaluable hire' and refused to change his position, arguing his background helped protect customers.
Edward Snowden Warns Users to Stop Using ExpressVPN
Former NSA whistleblower Edward Snowden publicly warned users to abandon ExpressVPN, posting 'If you're an ExpressVPN customer, you shouldn't be.' The warning, triggered by the DOJ's revelations about Daniel Gericke's Project Raven involvement, amplified public concern about trusting a privacy tool whose senior executive hacked human rights activists for a foreign government.
ExpressVPN Employees Protest Gericke's Role Internally
ExpressVPN employees raised internal complaints about Daniel Gericke's continued employment. Over 40 employees voted to escalate questions about his role during an internal session. One employee wrote: 'This episode has eroded consumer's trust in our brand, regardless of the facts. How do we intend to rebuild our reputation?' Management maintained its support for Gericke.
Gizmodo Publishes 'You Should Probably Stop Using ExpressVPN'
Gizmodo published an article headlined 'You Should Probably Stop Using ExpressVPN' on September 24, 2021, days after the DOJ disclosed CIO Daniel Gericke's Project Raven role and Kape announced its acquisition of ExpressVPN. The article cited Gericke's work for the UAE, Kape's past as Crossrider (maker of what CNET called data-huffing adware), its buying spree of CyberGhost, ZenMate and Private Internet Access, and majority owner Teddy Sagi's 1990s guilty plea to bribery and market-manipulation charges, and said it was not out of the question for customers to quit the service.
Kape Completes ExpressVPN Acquisition for $936 Million
Kape Technologies formally completed the acquisition of Express VPN International Ltd from Access Global Limited. The deal closed three months after its announcement, giving Kape ownership of four VPN brands (ExpressVPN, CyberGhost, PIA, ZenMate) plus two major VPN review sites (vpnMentor, Wizcase), creating unprecedented consolidation in the consumer VPN market.
ExpressVPN Offers One-Time $100K Bounty for First Server Hack
ExpressVPN added a one-time $100,000 bonus to its Bugcrowd bug bounty for the first valid report of a vulnerability in its VPN servers allowing unauthorized access, remote code execution, exposure of client IPs or traffic monitoring, putting its TrustedServer RAM-only design to a public test. The program already had 22 successful claimants.
ExpressVPN Launches Keys Password Manager
ExpressVPN unveiled its Keys password manager feature in beta, initially available as a Chrome extension and built into the Android app. Keys allowed users to create unique passwords and store them in a digital vault. Notably, Keys was included in ExpressVPN subscriptions at no extra cost — a benefit that would later be moved behind a paywall in the 2025 tiered pricing restructuring.
DNS Leak Bug Introduced in Windows Split Tunneling Feature
ExpressVPN version 12.23.1 for Windows introduced a bug (later assigned CVE-2024-25728) that caused DNS requests to leak to users' ISPs when split tunneling was enabled. The vulnerability went undetected for nearly two years, affecting all Windows versions through 12.72.0, exposing the browsing domains of approximately 1% of Windows users using split tunneling.
ExpressVPN Removes Indian Servers Over Data Retention Mandate
ExpressVPN removed its physical servers from India after India's CERT-In mandated that VPN providers store user data including real names, IP addresses, and usage patterns for at least five years. ExpressVPN stated its RAM-only TrustedServer architecture was incompatible with the regulation and instead offered virtual server locations routing through Singapore and the UK.
ExpressVPN Launches Aircove VPN Router Hardware
ExpressVPN launched Aircove, a Wi-Fi 6 router with ExpressVPN's VPN software built in, as its first hardware product, at a launch price of $169 (regular $189.90). Its built-in VPN works only with an ExpressVPN subscription and cannot be used with other VPN providers; without a subscription it functions only as a standard router. This created ExpressVPN's first hardware lock-in vector.
Teddy Sagi's Unikmind Launches $1.5 Billion Bid to Take Kape Private
Unikmind Holdings, Teddy Sagi's company holding about 54.8% of Kape Technologies, announced a cash offer for the remaining shares at $3.44 per share (285 pence), valuing Kape at approximately $1.51 billion, after an earlier 265p approach was rejected. Unikmind said it would seek a shareholder vote to delist Kape from AIM regardless of the offer's outcome. In April 2023 the offer was raised to a final $3.60 (290p) per share.
Kape Technologies Delisted from London Stock Exchange
After securing acceptances for 98.54% of shares, Unikmind completed its privatization of Kape Technologies on May 31, 2023. The delisting from AIM eliminated all public financial reporting requirements, making it impossible for users, journalists, or competitors to assess the company's financial health, R&D investment, or strategic direction.
Founder Peter Burchhardt Departs ExpressVPN
ExpressVPN co-founder Peter Burchhardt announced his departure from the company in June 2023, around the time Kape was taken private. On his own website Burchhardt says he sold the business in 2021 and completed his transition to the new owners in 2023. Kape said co-founder Dan Pomerantz remained an active leader in the business.
Kape Lays Off ~200 Employees Including ExpressVPN Leadership
Kape Technologies laid off approximately 180-200 employees (12-30% of workforce, depending on source) following its privatization. The layoffs impacted teams across engineering, IT, support, HR, design, marketing, and operations. Daniel Gericke announced his departure as CTO of ExpressVPN and the Kape Privacy Division. Reports suggest ExpressVPN's team took a disproportionate hit.
Nearly Two-Year DNS Leak Bug Disclosed (CVE-2024-25728)
CNET journalist Attila Tomaschek discovered that ExpressVPN's Windows split tunneling feature had been leaking DNS requests to users' ISPs since May 2022. The vulnerability (CVE-2024-25728) affected versions 12.23.1 through 12.72.0. ExpressVPN temporarily disabled split tunneling in version 12.73.0 and released a fix in versions 12.74.0 and 10.51.0 on February 21, 2024.
Tom's Guide Drops ExpressVPN From Top Spot It Held for Five Years
Tom's Guide, which had ranked ExpressVPN first in its best-VPN guide for over five years, moved it below NordVPN and Surfshark in March 2024; by March 2025 it ranked third.
ExpressVPN Launches Aircove Go Portable VPN Router
ExpressVPN expanded its hardware line with Aircove Go, a palm-sized portable Wi-Fi 6 VPN router priced at $169.90. Like the original Aircove, it only works with ExpressVPN subscriptions, extending the hardware lock-in strategy to travelers. The device includes a USB-C power adapter and Wi-Fi Link for connecting to local hotspots.
ExpressVPN Launches Identity Defender Suite for U.S. Users
ExpressVPN introduced Identity Defender for U.S. users, a suite of ID Alerts, ID Theft Insurance (up to $1 million) and Data Removal. ID Alerts came with all new plans, while the insurance and data removal were included only with new 2-year subscriptions. The suite would later be tied to the Advanced and Pro tiers in the September 2025 pricing restructuring.
ExpressVPN Enters eSIM Market With Holiday.com
ExpressVPN launched Holiday.com, a travel eSIM data service covering more than 200 countries with plans from 1GB to 20GB and special offers for ExpressVPN users. It was the first of several products that turned ExpressVPN from a single VPN into a portfolio of paid services.
ExpressVPN Rewrites Lightway Protocol in Rust for Memory Safety
ExpressVPN announced the complete reimplementation of its Lightway protocol in Rust, eliminating memory-safety vulnerabilities inherent in the original C implementation. The rewrite was backed by security audits from Cure53 and Praetorian conducted in late 2024, finding only low-risk issues. The Rust version rolled out to Aircove first, with platform-specific releases through 2025.
ExpressVPN Launches Lightway Turbo for Faster Windows Speeds
ExpressVPN introduced Lightway Turbo on Windows, which spreads traffic across multiple tunnels, CPU cores and server instances, and added Data Channel Offload for OpenVPN. Turbo is on by default for Lightway UDP users but not yet compatible with split tunneling.
Second Round of Layoffs at ExpressVPN
ExpressVPN announced its second workforce reduction in two years, stating it could deliver its service 'more efficiently.' The company did not disclose the number of jobs cut, only that it had taken the 'difficult decision to reduce the size of our workforce.' This followed the July 2023 layoffs of approximately 180-200 employees, continuing the cost-cutting pattern since privatization.
RDP Vulnerability Exposes User IPs in Remote Desktop Sessions
Security researcher 'Adam-X' reported a vulnerability through ExpressVPN's bug bounty program that exposed users' real IP addresses during Remote Desktop Protocol sessions. Debug code intended for internal testing had been mistakenly included in production builds (versions 12.97 to 12.101.0.2-beta), causing RDP traffic to bypass the VPN tunnel. A fix was released on June 18, 2025.
Class Action Filed Over Illegal Auto-Renewal Practices (Millar v. Express Technologies)
Plaintiff Timothy Millar filed a class action (Millar v. Express Technologies Ltd., No. 8:25-cv-01273) in the U.S. District Court for the Central District of California, alleging ExpressVPN violated California's Automatic Renewal Law by enrolling users in auto-renewing subscriptions without clear disclosures or affirmative consent. Millar claimed he purchased a one-month plan in September 2022 believing it was a one-time purchase.
ExpressVPN Introduces Three-Tier Pricing Restructuring
ExpressVPN made the biggest pricing change in its 16-year history, replacing its single subscription plan with Basic ($3.49/month), Advanced ($4.49/month) and Pro ($7.49/month) tiers on 2-year plans. The entry price dropped, with a two-year Basic plan costing about 30 percent less than a two-year subscription used to, but features that had been included for all subscribers, such as the Keys password manager, and the Identity Defender tools moved to the higher-priced Advanced and Pro tiers, effectively unbundling the existing product.
ExpressVPN Team Launches EventVPN, an Ad-Supported Free VPN
The ExpressVPN team launched EventVPN, a separate free VPN for iOS and macOS on ExpressVPN's server network. Free users watch a short ad before and after each session; premium ($9.99/month or $69.99/year) removes ads. It uses anonymous token authentication rather than accounts and is not covered by ExpressVPN's audit program.
Court Sends Millar's Auto-Renewal Claim to Arbitration
In Millar v. Express Technologies (C.D. Cal. 8:25-cv-01273), Judge Fred W. Slaughter granted ExpressVPN's motion in part: plaintiffs' UCL and FAL claims were dismissed without prejudice to refiling in state court, Timothy Millar's CLRA claim was compelled to arbitration, and co-plaintiff Marco Martinez's CLRA claim was allowed to proceed.
ExpressVPN Retires Legacy App Versions After March 31, 2026
ExpressVPN announced that app versions not updated by March 31, 2026 would stop connecting, as it retires older security certificates in favor of new credentials that support its post-quantum features. Users on every platform must update; Aircove owners update through the router dashboard and third-party routers running ExpressVPN firmware receive an automatic update. Separately, ExpressVPN has ended firmware support for a number of older third-party router models; router seller FlashRouters lists the Linksys WRT3200ACM, older Asus RT-AC models and Netgear R-series routers among them. Tom's Guide reported that ExpressVPN's original messaging indicated third-party routers would stop connecting after March 31, 2026 and that users would need a $200 Aircove to keep router-level VPN, before the company said in April 2026 that non-Aircove routers could still connect.
ExpressVPN Splits Keys and Adds MailGuard as Standalone Tier-Gated Apps
ExpressVPN launched a four-product suite: the ExpressKeys password manager (replacing the in-app Keys feature, which was removed from the VPN app on March 5, 2026), the ExpressMailGuard email-alias service, a standalone US-only Identity Defender app (from February 26) and the delayed ExpressAI. All four are folded into the Basic/Advanced/Pro tiers, with access varying by plan.
Illinois Judge Defers Ruling on Forum Clause; ExpressVPN Appeals to Seventh Circuit
In Greenwood v. Express VPN International (N.D. Ill. 1:25-cv-08121), the WMP-led $50M auto-renewal suit, Judge Jorge L. Alonso denied ExpressVPN's motion to dismiss or compel arbitration without prejudice and ordered briefing on its forum-selection clause. ExpressVPN filed a notice of appeal the next day (7th Cir. No. 26-1628); both sides had filed briefs by June 2026.
ExpressVPN Launches ExpressAI Private AI Platform
ExpressVPN launched ExpressAI, an AI chat platform that decrypts conversations only inside confidential-computing enclaves, does not train on user prompts or files, and offers five open-weight models at launch. Cure53 audited it before release.
ExpressVPN Clarifies Third-Party Router Support After User Backlash
Messaging in late 2024 had told users that third-party routers would stop connecting to the ExpressVPN router app after March 31, 2026, and some users quit rather than buy a $200 Aircove. After the deadline, ExpressVPN told Tom's Guide that non-Aircove routers can still connect with the latest firmware or by manual configuration. It gave no commitment on future security updates for those routers.
California Auto-Renewal Suit Stayed Pending Class-Wide Settlement
After the parties stipulated in April 2026 to stay the Millar case pending settlement, the federal court on May 22, 2026 stayed proceedings pending California state-court approval of a class-wide settlement of the remaining auto-renewal claims. Millar's own claim was dismissed with prejudice in June 2026. The settlement terms are not public on the federal docket.
ExpressVPN Reaches 27 Independent Audits
Cure53 audited ExpressMailGuard and Identity Defender, bringing ExpressVPN to 27 published independent security audits since its first in 2018. The company said this was more than any other VPN provider.
Aircove Retired as ExpressVPN Launches GL.iNet-Built Fortify Router
ExpressVPN retired its Aircove and Aircove Go routers from sale and launched Fortify (GL-MT6000), a $199.99 router built on GL.iNet's Flint 2 platform and bundled with 12 months of the Advanced plan. Aircove keeps firmware updates through 2027 and Aircove Go through 2028, and owners get a 20% upgrade discount.
Evidence (51 citations)
D1: User Value Erosion
D2: Business Customer Exploitation
D3: Shareholder Extraction
D4: Lock-in & Switching Costs
D5: Twiddling & Algorithmic Opacity
D6: Dark Patterns
D7: Advertising & Monetization Pressure
D8: Competitive Conduct
D9: Labor & Governance
D10: Regulatory & Legal Posture
Scoring Log (8 entries)
Checked 97 items (46 timeline, 42 evidence, 7 milestones, 2 alternatives) + prose. 51 verified, 34 corrected (17 date-only), 10 re-sourced, 2 removed. Invented/contradicted: Aircove 'paperweight' without subscription (ExpressVPN launch post: works as a standard router); Burchhardt 'last original founder' (Kape: co-founder Pomerantz remained); CyberGhost '$10.5M' (EUR 9.2M, Business Review); Crossrider sold '16 months' after founding (Globes: April 2011 to Dec 2012); third-party router firmware 'ceases connecting' after 2026-03-31 (TechRadar: routers auto-updated). Also fixed $50M figure misattributed to the Millar suit (belongs to WMP's Illinois suit), $100K bounty misdated to 2020, 12.73.0 vs 12.74.0 fix, $3.60 offer misdated to Feb 2023, 2024 vs March 2025 layoffs, $1M vs $5M ID insurance at launch; trimmed unsupported $95 affiliate figure and forum speed claims.
57→41. Since Feb 2026 (window from Sep 2025): tiered pricing (Sep 2025), EventVPN free ad-supported app, standalone ExpressKeys/MailGuard/Identity Defender (Feb 2026), ExpressAI (Mar 2026), 27 audits (May 2026), Aircove retired for GL.iNet Fortify (Sep 2026), router-support clarification (Apr 2026); Millar suit: Millar compelled to arbitration (Nov 2025), class-wide settlement pending CA state-court approval (May 2026); Greenwood (N.D. Ill.) dismissal denied pending forum-clause briefing, ExpressVPN appealed to 7th Cir. (Mar 2026); no new layoffs or regulator action. D1 5→4 (correction: router 'paperweight'/'ceases connecting' claims contradicted; core VPN still improving), D2 3→2 (recalibration: single-sided product, $95 commission unsupported), D3 7→4 (recalibration: no buybacks/dividends or record-profit layoffs on record; visible product investment), D4 4→3 (correction: Aircove works as normal router without subscription; many competitors), D5 5→4 (recalibration: non-algorithmic; audits/transparency reports offset ownership and pricing opacity), D6 6→5 (correction: Aircove 'forced continuity' contradicted; ARL allegations unproven, settlement pending), D7 5→4 (correction: $95 affiliate figure unsupported; entry price fell, Basic keeps full VPN), D8 8→6 (recalibration: no dominant position or antitrust action; review-site self-preferencing fits 6), D9 8→5 (recalibration: Gericke left 2023; no anti-union/retaliation record), D10 6→4 (recalibration: no regulator enforcement, strong audit record; legalistic ARL defense). Eras: merged 'Privacy Startup'+'BVI Incorporation' → 'Independent Privacy Startup' (2009-01-01); 'Peak Reputation' re-dated 2019-06-01→2019-04-17 (TrustedServer); merged 'Kape Acquisition Shock'+'Integration & Lock-In' → 'Kape Takeover & Raven Scandal' re-dated 2021-10-01→2021-09-13 (acquisition announced); 'Privatization & Purge' re-dated 2023-07-01→2023-05-31 (LSE delisting) and relabeled 'Privatization & Layoffs'; current era re-dated 2026-02-11→2025-09-02 (tiered pricing) and relabeled 'Tiered Privacy Suite'. Proton alternative description trimmed.
Checked 8 removed/trimmed claims: 1 restored, 4 partly restored, 3 confirmed removed, 0 already present. Restored: Engadget 30% cheaper two-year Basic plan. Partly: Gizmodo article content (Wayback), Pixel Envy 'Kape appears nowhere' line, Burchhardt 2021 sale/2023 transition (added evidence from peterburchhardt.com), router model list (FlashRouters) and Aircove messaging (Tom's Guide). Confirmed removed: FrankelineTech (URL redirects to unrelated article), Roya News (misdates Kape privatization to 2026), $95 affiliate figure (only WebsiteRating blog; directories list $13-$36).
Triaged 2026-06-30 (Wave A); no rescore warranted (no material change / changes sub-threshold / flag refuted on verification).
Added 1 missing dimension narrative