Can a VPN Be Hacked?

To understand if a VPN can be hacked, you first need to understand exactly how a VPN works.

To hack your VPN connection, a hacker would have to compromise your data at some point during this process.

This may involve attempting to decrypt the data using a brute force attack, capturing data sent outside the VPN tunnel, or compromising the VPN server itself.

Below is a more comprehensive explanation of how a VPN can be hacked:

1. Through Vulnerabilities In VPN Protocols

VPN protocols describe the rules that your VPN uses to create a secure connection between your device and the VPN server. The most common protocols in consumer VPN services are OpenVPN and WireGuard.

Some VPN services let you choose a preferred protocol, while others don’t let you choose at all. Each protocol has its own strengths and weaknesses, and some are much more secure than others.

If there is a vulnerability in the underlying protocol you’re using, your VPN connection can be hacked. This could happen as a result of design flaws if the protocol is newly developed, or simply because the VPN client hasn’t been configured properly.

For example, the PPTP protocol is no longer considered secure due to reports that the NSA cracked a PPTP VPN connection to spy on a target. Despite being outdated, it’s still included as an option by some VPN services.

2. Through Cryptographic Attacks

To convert your web traffic into an unintelligible code, VPNs need to use an encryption cipher. This simply refers to the algorithm used to encrypt and decrypt your data.

The most common ciphers used in VPN services are AES, ChaCha20, and Blowfish – though the latter is fairly rare.

Ciphers are usually paired with a key-length, which describes the number of digits in the encryption key. At its simplest, longer key lengths are usually more secure. For example, AES-256 is considered more secure than AES-128.

Due to advancements in computing, older hash functions and encryption ciphers can be broken in a shorter amount of time, making it possible to hack a VPN connection if it uses an outdated cipher.

For example, the SHA-1 hash function is cryptographically broken, and the Blowfish cipher is susceptible to “birthday attacks” (a statistical shortcut that lets attackers break weak encryption faster than expected).

These cryptographic functions are unfortunately still used by several low-quality VPNs.

A VPN shouldn’t use anything less than the AES-256 cipher to encrypt your data. ChaCha20 is a secure alternative for WireGuard users that also uses 256 bits, which means it’s equally as secure as AES-256 encryption.

What About Quantum Computers?

You may have seen warnings that quantum computers will one day break today’s encryption. This is a real long-term concern, but not an immediate one.

The bigger near-term risk is called Store Now, Decrypt Later (SNDL): an attacker logs and stores your encrypted traffic today, betting they’ll be able to crack it once quantum computers are powerful enough.

To stay ahead of this, many leading VPNs like NordVPN, ExpressVPN, and Surfshark have rolled out post-quantum encryption (PQE). This is encryption designed to resist quantum attacks.

These services use a “hybrid” approach that combines today’s proven ciphers with new quantum-resistant algorithms based on the standards finalized by NIST (the US standards body). You’ll therefore be protected against both current and future threats at once.

3. Through IP, DNS, or WebRTC leaks

A hacker can also compromise your identity without breaking the VPN connection at all by looking for data traveling outside the VPN tunnel. This is known as a “VPN leak.”

For instance, your real IP address can be exposed if your VPN doesn’t encrypt any IPv6 requests made by your browser, which some VPNs are unable to protect against.

Or, if it doesn’t re-route WebRTC connections (a browser feature used for video and voice calls that can leak your real IP address).

Similarly, your browsing activity can be exposed if your DNS requests are handled by your ISP rather than the VPN service, or if the VPN kill switch isn’t working.

Most top-rated VPNs now include leak protection by default, which should keep you safe on most connections. You can also use our dedicated tool to check if your VPN is leaking.

4. By Compromising a VPN Server

If an attacker can’t compromise your VPN connection directly, they may be able to target the VPN service itself.

It’s possible for VPN servers to be misconfigured or set with weak login credentials, which makes them an easy target for hackers.

If an attacker gains entry to the server, they can access your personal information, browsing history, and future activity when connected to the server.

For example, one of NordVPN’s servers was breached in March 2018 due to a third-party error. This allowed hackers to see which users were connected to the breached server, as well as the websites they were visiting.

In March 2021, SuperVPN, GeckoVPN, and ChatVPN were also hacked. As a result, the names, email addresses, location, and payment information of 21 million users were made public.

The risk of your VPN server being compromised is significantly reduced if you choose a premium VPN service with a history of third-party security audits.

For even more reassurance, use a VPN with RAM-only servers to prevent your data ever being written to the hard drive.

5. By Stealing Encryption Keys

If hackers obtain the encryption keys used to secure your data, they can hack your VPN connection and read all of the incoming and outgoing traffic.

Fortunately, most VPN software encapsulates its encryption keys, and most top-tier VPNs use Perfect Forward Secrecy (PFS) by default.

PFS is a protocol feature which ensures your VPN server and client use unique symmetric keys for every VPN session.

Both sides generate the key independently, and the key is never exchanged across the connection. A new key is automatically issued for each session, making the previous key obsolete.

In short, Perfect Forward Secrecy removes the threat of a single encryption key that would expose all of your VPN sessions if compromised.

Instead, the temporary keys ensure that a hacker could only ever expose one specific session, and nothing more.

Using a VPN minimizes the risk of getting hacked, but it doesn’t completely eliminate it.

VPNs use encryption to hide the details of your browsing activity as it travels between your device and the VPN server. If an attacker intercepts your connection on an unprotected WiFi network, they should only see strings of unintelligible letters and numbers.

This can protect you from ISP surveillance, Man-in-the-Middle attacks, network monitoring, and other forms of surveillance.

However, VPN software won’t protect you from hackers installing malicious software, performing phishing attacks, or attempting other local attacks on your device. In short, you can still get hacked while using a VPN.

Some VPN services provide threat management features like NordVPN’s Threat Protection, which can block access to URLs that are known to be malicious. However, it’s still possible to get hacked when using these services.

Here’s a list of situations in which a VPN service won’t protect you from hackers:

1. If a Third-Party Website Is Breached

If hackers are able to gain access to the database of a website that you visit frequently, they may be able to read any unencrypted data stored on that server.

Any personal information you’ve submitted including your email address, password, contact info, and more could be exposed.

In this case, using a VPN may prevent your true IP address from being revealed, but it won’t protect any other identifying information you’ve submitted.

2. If Your Device Is Already Infected

If your device has already been compromised and hackers can access the device remotely, they can use privilege escalation techniques to record your screen, keystrokes, camera, and microphone.

In this case, using a VPN won’t restrict the hacker’s access to your computer.

3. If You Download and Install Malicious Software

Installing unknown software from the internet can silently install malware alongside it. Some browser extensions can also compromise your privacy and security. A VPN won’t protect you if you download software from an untrustworthy source.

Malicious USB drives, hubs, and cables can also infect your device, regardless of your VPN connection. Using a VPN when these devices are plugged in won’t prevent you from getting hacked.

4. If You Click a Malicious Link

VPN services won’t protect you from phishing scams and other social engineering attacks. Be cautious about the links you click on and the files you download to your device.

Some VPNs provide threat protection features that can block DNS requests to known malicious URLs. These features can reduce the risk of falling for phishing attacks, but they’re not always effective.

5. If Another Device In Your Local Network Is Infected

If you’re sharing a local network with another compromised device, it’s possible for hackers to employ techniques such as ARP spoofing (device impersonation) to try and infect your computer.

Depending on the configuration of the network, a VPN may or may not protect you from this form of attack.

How to Choose a VPN to Protect Yourself From Hackers

Using a VPN may not be a catch-all solution for every type of cyber attack, but it can significantly reduce your chances of getting hacked on most unsecured networks.

Not all VPNs are the same, though. If you’re looking to find a VPN for security reasons, you’ll need a service with robust security features that will stand up to any potential attacks.