NordVPN
NordVPN is a virtual private network service that encrypts internet traffic and masks users' IP addresses for privacy and security. It's designed for individuals and businesses seeking online privacy, secure browsing, and access to geo-restricted content across multiple devices.
Score generated by AI agents based on publicly cited evidence and reviewed by the project maintainer. Not independently validated. Last assessed 2026-10-01. Score revised 2026-10-01: 53 → 41.
Score History
Timeline events are AI-curated from public reporting. Score trajectory is derived from documented events.
NordVPN launched as a bootstrapped VPN run from Lithuania through a Panama-registered entity, with no outside investors. It sold a single VPN subscription and expanded to Android and iOS in 2016. Few enshittification pressures were visible, though the multi-jurisdictional structure and Tesonet ties were already in place.
Luminati's July 2018 patent suit against Tesonet and the allegations that followed exposed NordVPN's ties to an incubator running proxy and data-scraping businesses. NordVPN answered with its first independent no-logs audit (PwC, November 2018), while the UK ASA ruled in May 2019 that its fear-based public Wi-Fi TV ad was misleading. Trust and corporate opacity, not product decline, defined the period.
NordVPN confirmed in October 2019 that a Finnish server had been breached in March 2018, a disclosure delay widely criticized. It responded with a bug bounty, infrastructure audits and colocated RAM-only servers, and rolled out NordLynx. Nord Security also launched NordPass and NordLocker, became YouTube's top influencer-marketing spender in Q3 2020 and bought Atlas VPN in October 2021.
The merger with Surfshark under Cyberspace B.V. and the first outside funding ($100 million at $1.6 billion in April 2022, another $100 million at $3 billion in September 2023) turned a bootstrapped company into a venture-backed consolidator. The product kept improving: Meshnet launched in 2022 and became free in 2023, the Linux client was open-sourced, and NordVPN pulled its India servers rather than log users. Renewal practices later challenged in court were already in use (one plaintiff says he was charged for an unwanted renewal in 2023), and the ASA again ruled an ad misleading in January 2023.
The first auto-renewal class action, filed in California in April 2024, was followed by suits in North Carolina, Colorado, New York, Illinois and Massachusetts alleging hidden renewal terms, early renewal charges and buried cancellation. Nord shut Atlas VPN, added a Prime tier with NordProtect, and Tom's Guide documented renewal hikes of up to 350%. The planned Meshnet shutdown in August 2025 was reversed after user backlash.
Weeks after Fitch's first 'BB' rating, Nord Security completed a dividend recapitalization (reported at $625 million), its first debt-funded payout to owners. New auto-renewal suits followed in Massachusetts, Virginia and Connecticut before the cases moved to settlement: by July 2026 a class action settlement agreement had been executed and the claims were consolidated in New York. The product kept improving, with the Linux GUI open-sourced, Meshnet retained and a sixth no-logs audit.
Alternatives
Privacy-first VPN with a flat €5/month price that has never changed, no email signup required, and cash and cryptocurrency accepted. No affiliate program means reviews aren't financially compromised. Easy switch, though the server network is smaller than NordVPN's.
Swiss-based, open-source VPN with an audited no-logs policy and far gentler renewal pricing: Tom's Guide measured an 86% renewal increase on its 2-year plan versus 288% for NordVPN Basic. Operated by Proton AG, the company behind Proton Mail, not a VC-backed consolidator. Easy switch: apps on all major platforms and a free tier available.
Dimensional Breakdown
Summaries below were written by AI agents based on the cited evidence. They are editorial interpretations, not independent research findings.
Dimension History
Timeline (45 events)
NordVPN launches Android and iOS mobile apps
NordVPN expanded beyond desktop by releasing its Android app in May 2016, followed by iOS in June 2016. This expanded the product's addressable market significantly and established NordVPN as a cross-platform VPN provider, laying groundwork for the influencer marketing machine that would follow.
Luminati sues Tesonet over proxy patent infringement
Luminati Networks (now Bright Data), the company behind Hola VPN, filed a patent infringement suit against UAB Tesonet in the Eastern District of Texas (No. 2:18-cv-00299), alleging that Tesonet's OxyLabs residential proxy service infringed its proxy patents. The complaint also claimed NordVPN had a business relationship with Hola, which fed questions about whether NordVPN user bandwidth could be repurposed for proxy services; NordVPN said Hola had only been a minor referral affiliate.
Tesonet data mining allegations surface publicly
In August 2018, amid a wave of online allegations (many pushed by newly active Twitter accounts), NordVPN was linked to Tesonet, a Lithuanian tech company that runs data-mining and residential proxy businesses. NordVPN told TorrentFreak it is operated by Panama-based Tefincom, which holds the NordVPN trademark, and that Tesonet is a partner that never owned it and has no role in its other projects. NordVPN called the claims a competitor-driven smear campaign and promised an independent no-logs audit.
NordVPN commissions first independent no-logs audit
In response to the Tesonet allegations, NordVPN became the first major VPN provider to commission an independent no-logs audit, conducted by PricewaterhouseCoopers AG Switzerland. The audit verified that NordVPN's infrastructure did not retain user traffic logs, partially restoring trust after the Tesonet controversy.
UK ad watchdog rules NordVPN public Wi-Fi TV ad misleading
The UK Advertising Standards Authority ruled that a NordVPN TV ad, which showed a train passenger handing his card, phone and passwords to strangers, misleadingly implied that public Wi-Fi is inherently insecure. Nine people had complained; NordVPN was told not to repeat the claims.
Third-party server breach at Finnish data center
An unauthorized party accessed a NordVPN server in Finland through an insecure remote management system added by the data center provider without NordVPN's knowledge. The breach occurred in March 2018 but was not discovered until April 2019, and NordVPN did not publicly confirm it until October 2019. While no user credentials were compromised, an expired TLS key was obtained, and the delayed disclosure damaged trust.
Bruce Schneier criticizes NordVPN's delayed breach disclosure
Security researcher Bruce Schneier noted that the NordVPN breach had happened nineteen months before the company disclosed it publicly, called for more detail on what was stolen, and questioned how much users can trust VPN providers. The breach occurred in March 2018, NordVPN learned of it in April 2019, and it was not disclosed until October 2019, a gap researchers and media widely criticized for a company selling privacy.
NordVPN announces bug bounty program and security overhaul
Following the server breach disclosure, NordVPN published a security plan (October 26, 2019) promising a bug bounty program, a full third-party infrastructure audit and an upgrade of its 7,300+ servers to diskless RAM servers. The bug bounty went live on HackerOne on December 12, 2019, with bounties from $100 for minor issues to over $5,000 for critical flaws.
NordLocker encrypted cloud storage product launches
Nord Security launched NordLocker, a file encryption tool with secure sharing (an encrypted cloud storage add-on followed in August 2020), expanding its ecosystem beyond VPN into a multi-product security suite. This laid the foundation for future bundled pricing tiers.
NordPass password manager launches
Nord Security released NordPass, a password manager, further expanding its product suite. Combined with NordLocker and the core VPN, this created the foundation for a bundled ecosystem that would later become the four-tier pricing structure (Basic, Plus, Complete, Prime), increasing cross-product lock-in.
NordLynx WireGuard-based protocol rolls out across NordVPN apps
NordVPN began rolling out NordLynx, its proprietary WireGuard-based protocol with a custom double-NAT system to avoid storing user identities on servers, to its Windows, Mac, Android and iOS apps (Linux had it since July 2019). At launch OpenVPN remained the default protocol and users had to select NordLynx manually; it later became the default. NordLynx is a NordVPN-only implementation, though WireGuard itself is available from many competitors.
NordVPN becomes top YouTube influencer-marketing spender in Q3 2020
NeoReach's Q3 2020 analysis of US and Canadian YouTube brand deals found NordVPN spent $12 million on influencer marketing that quarter, 17% of the tech industry's YouTube sponsorship spend, making it the top tech spender and the top spender on YouTube overall in Q3. Its sponsored videos reached 2.2 billion, with 70 million views and 5.7 million likes, building a pervasive affiliate ecosystem where VPN recommendations were heavily influenced by financial incentives.
NordVPN begins colocated RAM-only server migration
NordVPN started deploying colocated RAM-only servers in Finland, with full control over hardware to prevent third-party breaches like the 2019 incident. The RAM-based architecture ensures no data persists on servers if they are seized or physically compromised, addressing a key trust deficit from the breach era.
Kape-owned VPN review sites drop NordVPN after acquisition
CyberInsider documented that Kape Technologies bought Webselenese, owner of review sites vpnMentor and Wizcase, for $149.1 million in March 2021, after which NordVPN and Surfshark were removed from the sites' top recommendations while Kape's CyberGhost and Private Internet Access moved up. The review ecosystem consumers relied upon was structurally compromised by VPN-company ownership.
Nord Security acquires Atlas VPN
Nord Security acquired freemium VPN provider Atlas VPN, its first purchase of an outside VPN brand. Atlas VPN, founded in 2019, had more than 6 million users at the time; deal terms were not disclosed. The acquisition brought a free-tier competitor into Nord's portfolio as rivals Kape Technologies and Ziff Davis were also buying up VPN brands.
Nord Security and Surfshark announce merger under Cyberspace B.V.
Nord Security and Surfshark finalized a merger creating Cyberspace B.V., a holding company registered in the Netherlands. Both brands said they would continue operating autonomously with separate infrastructure and product roadmaps, maintaining the appearance of competition while sharing corporate ownership.
Nord Security raises first external capital at $1.6B valuation
After a decade of bootstrapped growth, Nord Security raised $100 million in its first external investment round led by Novator, with participation from Burda Principal Investments and General Catalyst. The $1.6 billion valuation marked Nord's transition from a bootstrapped privacy company to a venture-backed growth company with external investor pressure for returns.
NordVPN pulls its servers out of India rather than log users
NordVPN confirmed it would remove its Indian servers by June 26, 2022, ahead of a CERT-In directive requiring VPN providers to store customers' names, emails, IP addresses and transaction records for five years. NordVPN said it keeps no logs and was committed to protecting its customers' privacy, following ExpressVPN and Surfshark.
ASA rules NordVPN 'switch off malware' radio ad misleading
The UK ASA upheld a complaint about a NordVPN radio ad heard in August 2022 that told listeners to 'switch off ... malware'. It found the unqualified claim implied protection against all malware attacks, which NordVPN had not substantiated, and ruled the ad must not appear again in that form.
Meshnet made free and Linux client open-sourced
NordVPN made Meshnet, its encrypted device-to-device networking feature launched for paying subscribers in June 2022, free for everyone, and released the source code of its Linux app and of the libtelio and libdrop libraries. The changes added value for non-paying users and opened part of the client to outside scrutiny.
Nord Security doubles valuation to $3B with second $100M round
Nord Security raised another $100 million in a round from Warburg Pincus, with existing investors Novator Ventures and Burda Principal Investments participating, doubling its valuation to $3 billion about 18 months after its first round. The company said it would use the funds to expand its products and accelerate growth through mergers and acquisitions. With $200 million in external capital and institutional investor pressure, the incentive to maximize revenue extraction through aggressive pricing and feature-gating intensified.
Atlas VPN shut down, paid users migrated to NordVPN
Nord Security shut down Atlas VPN, citing 'insurmountable challenges' including competition and rising costs. Paid users were automatically migrated to NordVPN for the rest of their subscription; free users lost their VPN service and Apple App Store subscribers were refunded instead of migrated. The shutdown eliminated a lower-cost freemium brand and consolidated paying subscribers under the higher-priced NordVPN brand.
First class action lawsuit filed in California over auto-renewals
Wittels McInturff Palikovic filed the first class action against NordVPN in the Northern District of California (Civil Action No. 24-2462), alleging deceptive automatic-renewal practices: misleading consumers about subscription auto-renewal, making cancellation difficult, and charging higher renewal fees without adequate disclosure. The firm characterized these practices as 'dark patterns.'
Second class action filed in North Carolina
WMP filed a second class action against NordVPN in the Western District of North Carolina (Civil Action No. 24-277), alleging the same deceptive auto-renewal patterns as its California case, including shady practices around cancellations during the 30-day money-back period. WMP said its suits sought up to $100 million.
Tiered pricing gates security features behind higher plans
Cybernews' September 2024 pricing guide listed three NordVPN tiers: Basic ($3.09/month on a 2-year plan), Plus ($3.99, adding Threat Protection Pro and a password manager) and Ultimate ($5.99, adding encrypted cloud storage). Advanced malware blocking, NordPass and NordLocker were gated behind the higher tiers, encouraging users to consolidate several security tools in one subscription; a Prime tier followed in November 2024.
NordVPN complies with Panamanian warrant, replaces warrant canary
NordVPN received and complied with a binding warrant from the Panamanian prosecutor's office, providing payment-related data and account confirmation. Simultaneously, the company transitioned from its warrant canary system to detailed transparency reports. This was the first confirmed instance of NordVPN complying with a law enforcement data request, though the company noted it could only provide payment metadata due to its no-logs policy.
NordVPN and Surfshark continue marketing as independent competitors
Despite merging in 2022, NordVPN and Surfshark continue to be marketed as separate brands under Nord Security's control, as Windscribe's VPN ownership map documented, while Kape Technologies runs ExpressVPN, CyberGhost and PIA alongside review/affiliate sites such as vpnMentor and Safety Detectives. Parallel marketing of commonly owned brands reduces genuine consumer choice while maintaining the appearance of a competitive marketplace.
NordProtect identity theft protection launches as Prime tier exclusive
Nord Security launched NordProtect, an identity theft protection service with credit monitoring, 24/7 dark web monitoring, up to $1 million in identity-recovery reimbursement and cyber extortion coverage. At launch it was available only to US subscribers on the NordVPN Prime plan, the highest-priced tier, further stratifying features across the pricing tiers.
Third class action filed in Colorado, lawsuits seek $100M total
Plaintiff Tim Peterson filed a class action against NordVPN S.A. and Tefincom S.A. in Colorado federal court (No. 1:24-cv-03218), alleging violations of Colorado's law requiring renewal notice 25-40 days in advance and charges 14 days before the subscription period ends. Together with the California and North Carolina suits, WMP's actions sought up to $100 million. The pattern of filings across multiple states suggested systematic rather than isolated practices.
Fourth class action filed in New York seeking $50M
Plaintiff Lanzy Kandeh filed a class action against NordVPN S.A., Tefincom S.A., and Nordsec B.V. in the Southern District of New York, seeking at least $50 million in damages for violations of New York consumer protection laws. The lawsuit repeated allegations of hidden renewal pricing, premature renewal charges, and deliberately difficult cancellation processes.
Fifth class action filed in Illinois seeking $50M (Sasgen v. NordVPN)
Plaintiff Michael Sasgen filed Case No. 1:25-cv-06822 in the Northern District of Illinois, alleging violations of the Illinois Automatic Contract Renewal Act and Illinois Consumer Fraud Act. The complaint sought at least $50 million, alleging NordVPN employs negative-option clauses where silence equals consent to renew, charges renewals 14 days before expiry, and buries cancellation in four layers of account settings.
NordVPN renewal pricing documented as most egregious among top VPNs
Tom's Guide research called NordVPN 'the most egregious' of the top VPN providers for inflated renewal rates. Its 2-year Basic plan ($2.99/month, $80.73 upfront at the time) renewed at $139.08 for the next 12 months, a 287.63% increase per month over the introductory rate. The Prime plan showed a 349.78% increase per month upon renewal.
Cybernews' ownership ties to Nord Security's founders scrutinized
SafePaper's analysis of 'hidden VPN relationships' highlighted that Cybernews, a prominent VPN review site, is owned by Mediatech, which has close ties to Tesonet. Cybernews' own editorial policy states Mediatech's investors are the founders of Nord Security (the company behind NordVPN and Surfshark) and that its editorial team alone decides coverage. The structural tie undermines the perceived objectivity of a major review platform that ranks Nord's brands.
NordVPN announces Meshnet shutdown, prompting user backlash
NordVPN announced plans to discontinue its Meshnet peer-to-peer networking feature by December 1, 2025, citing low adoption and high maintenance costs. Users on Reddit and social media responded with significant backlash, with many stating they used Meshnet more than the core VPN. Some threatened to cancel subscriptions and migrate to alternatives.
Fitch assigns Nord Security 'BB' credit rating
Fitch Ratings assigned Cyberspace B.V. (Nord Security) a first-time 'BB' Issuer Default Rating with a stable outlook, a sub-investment-grade rating that marks the company's move into institutional credit markets, a shift from its bootstrapped origins.
Nord Security completes a dividend recapitalization
Private-market data providers PitchBook and Private Market View list a dividend recapitalization by Nord Security dated September 23, 2025, which Private Market View puts at $625 million. A dividend recap borrows money to pay owners; it came two weeks after Fitch gave the group a first, sub-investment-grade 'BB' rating. The company has not published the terms.
NordVPN reverses Meshnet shutdown, pledges open-sourcing
Following sustained community backlash, NordVPN reversed its decision to discontinue Meshnet and committed to not only keeping the feature live but open-sourcing it. While this represented a positive response to user pressure, the initial shutdown attempt demonstrated willingness to remove features users valued when they did not align with business metrics.
NordVPN open-sources its Linux GUI client
NordVPN released the source code of its new Linux graphical client (version 4.2.0) under the GPLv3, adding to the command-line client and Meshnet library it open-sourced in 2023. Its Windows, macOS and mobile apps remain proprietary.
Sixth class action filed in Massachusetts seeking $50M
Plaintiff Rene Tio filed Case No. 1:25-cv-13374 in the District of Massachusetts, alleging NordVPN charges renewal fees before subscription expiration without adequate notice and denies refund requests despite advertising a 30-day money-back guarantee. The sixth class action across six states demonstrated a nationwide pattern of alleged deceptive renewal practices.
NordVPN completes sixth consecutive no-logs audit
Deloitte Lithuania completed a five-week assessment (November 10 to December 12, 2025) of NordVPN's systems, marking its sixth independent no-logs audit, under the ISAE 3000 (Revised) standard. It covered standard VPN servers and specialty servers including Double VPN, Onion over VPN and obfuscated servers, and confirmed NordVPN's no-logs claims. This sustained audit commitment provided some counterbalance to governance concerns.
Hacker claims NordVPN development server breach
A hacker posted on BreachForums claiming access to NordVPN source code and Salesforce/Jira data from a development server. NordVPN denied the breach on January 5, stating forensic analysis found no production infrastructure compromise. The company attributed the leaked artifacts to a third-party trial environment containing only dummy data, but the incident renewed scrutiny of Nord Security's security posture.
Nord Security and Surfshark group passes EUR 1 billion in annual revenue
The Nord Security and Surfshark group said its annual revenue had passed EUR 1 billion, that it had budgeted EUR 130 million for R&D in 2026, and that it employs more than 3,000 people across Lithuania, Poland, Germany and the Netherlands. It also said the group had separated structurally from the Tesonet accelerator in 2025.
New auto-renewal class actions filed in Virginia and Connecticut
Schnappinger v. NordVPN S.A. (E.D. Va.) and Daddabbo v. NordVPN S.A. (D. Conn.) were filed on April 10, 2026. The Virginia suit, seeking at least $100 million for Virginia and North Carolina customers of NordVPN, NordPass and NordLocker, alleged negative-option billing and renewal charges 14 days before expiry without clear warning. Nord said its terms are clear and that it updated its terms and conditions in February 2026.
Spanish court declines to fine NordVPN under LaLiga blocking order
A February 2026 injunction from a Córdoba commercial court, granted without hearing the VPNs, ordered NordVPN and Proton VPN to block IP addresses streaming pirated LaLiga matches. On May 19, 2026 the court rejected LaLiga's request for coercive fines after NordVPN showed that blanket IP blocking would cut off lawful sites; NordVPN noted the main case is still pending.
NordVPN executes class action settlement of auto-renewal suits
After reporting settlements in principle in April and May 2026, which stayed the Illinois, New York, Virginia and Connecticut cases, the parties told the Illinois court on July 27, 2026 that they had executed a class action settlement agreement. Plaintiffs from the separate suits were added to an amended complaint in the Southern District of New York to carry out the settlement; its terms had not been made public by September 2026.
Evidence (44 citations)
D1: User Value Erosion
D2: Business Customer Exploitation
D3: Shareholder Extraction
D4: Lock-in & Switching Costs
D5: Twiddling & Algorithmic Opacity
D6: Dark Patterns
D7: Advertising & Monetization Pressure
D8: Competitive Conduct
D9: Labor & Governance
D10: Regulatory & Legal Posture
Scoring Log (7 entries)
Checked 82 items + prose. 26 verified, 34 corrected (15 date-only), 17 re-sourced, 5 removed (3 timeline: undated 2019 complaints, undated 2021 tier restructure, junk whoowncompanies item; 2 junk-source evidence). Main fixes: NordLynx was not the default at 2020 launch; Atlas shutdown migrated only paid users (6M was Atlas's 2021 user count); 2024 pricing was three tiers at different prices; 4.4B YouTube views covers all VPNs; unsourced $400M revenue claim removed; '#1 and #3 providers' removed; Cybernews ownership disclosure corrected; several lawsuit items re-sourced to the right case pages; Proton alternative's 'no renewal hikes' corrected (86% hike). No figures traced to invention: mismatches were date/price drift or misattribution.
53->41. Since Feb 2026 (window from Oct 2025): Sept 2025 debt-funded dividend recap (reported $625M) after Fitch BB; Linux GUI open-sourced; Virginia and Connecticut auto-renewal suits (Apr 2026); settlements in principle Apr-May 2026 and an executed class action settlement agreement by Jul 2026, consolidated in SDNY; LaLiga blocking-order fine rejected (May 2026); group revenue passed EUR 1B with EUR 130M 2026 R&D budget. Dimensions: D1 5->3 (recalibration: core VPN not degraded, Meshnet shutdown reversed; renewal pricing scored under D6/D7), D2 3->2 (recalibration: single-sided product, affiliates well paid), D3 6->5 (recalibration: no layoffs and R&D growing; the 2025 dividend recap supports 5, not 6-7), D4 5->3 (recalibration: WireGuard-based, no network effects or data hostage; bundling and prepaid terms only), D6 8->7 (recalibration: online self-serve cancellation and no regulator finding; settlement executed, terms unknown), D7 6->5 (recalibration: paid product with no ads, tier ladder and renewal hikes fit 4-5), D8 7->5 (recalibration: 24% U.S. share in a fragmented market, no antitrust action; Atlas/Surfshark consolidation fits 4-5), D10 6->4 (recalibration: class actions settled, two ASA rulings, offset by India exit and transparency reports; no lobbying or legal threats found). D5 4 and D9 3 unchanged. Eras: 'Tesonet Trust Crisis' re-dated 2018-08-01->2018-07-19 (Luminati suit); 'Post-Breach Expansion' re-dated 2020-01-01->2019-10-21 (breach disclosure) and relabeled 'Post-Breach Rebuild'; 'Consolidation Wave' re-dated 2022-04-01->2022-02-02 (Surfshark merger) and relabeled 'Surfshark Merger'; 'Extraction Acceleration' re-dated 2024-04-01->2024-04-25 (first class action filing) and relabeled 'Auto-Renewal Litigation'; 'Lawsuit Deluge' (dated to the 2026-02-10 assessment) re-dated to 2025-09-23 (dividend recap) and relabeled 'Recap and Settlement'; 'Privacy Startup' kept. All eras re-scored from criteria; earlier D6/D8/D10 era scores lowered where searches found no dated events. Timeline event 17 date corrected to the docket filing date 2024-04-25.
No material changes since 2026-02-10. Checked news, litigation, M&A, pricing, leadership, and security incidents. Additional auto-renewal class actions filed (Feb/Mar 2026 and Apr 2026 in Virginia/Connecticut) continue the pattern already scored at baseline (D6=8, D10=6); no settlement, ruling, or FTC action. No leadership change, IPO, or confirmed breach; Jan 2026 Passwarden tuck-in acquisition and dev-server breach claim predate baseline or are immaterial.
Added 2 missing dimension narratives
Mullvad pricing is EUR 5 (~$5.50 USD), not exactly $5/month as described, but close enough