Data breaches have become routine news. The harder question for most people is which of the tools sold as protection actually help. A VPN is the most heavily advertised, and also the most misunderstood.
The numbers behind the headlines
The Identity Theft Resource Center (ITRC) tracks publicly reported data compromises in the United States. Its 2025 annual report, published in January 2026, counted more than 3,300 compromises, a record and a few percent above 2024.
The report also contains a counterintuitive figure. Victim notices fell roughly 80%, to about 279 million, because 2024 included several mega-breaches that did not repeat. The ITRC cautions that 8% of notices gave no count, so the total is likely an undercount.
Put together, the pattern is clear: more incidents, spread across more organizations, so a typical person’s data is spread across more places that can lose it.
Two different problems
It helps to separate two risks that often get lumped together.
Leaks happen when a company you gave data to is breached. Your email, password, address or ID ends up in someone else’s database. Nothing you do on your network changes that.
Surveillance happens in transit and in the background: who can see which sites you visit, where you are, and what profile gets built from it. Your internet provider is one of those parties. A U.S. Federal Trade Commission staff report on six large ISPs found they collect large amounts of customer data, combine it across lines of business, and in some cases share location data with third parties.
A VPN addresses the second problem. It does very little for the first.
What a VPN does
A VPN sends your traffic through an encrypted tunnel to a server run by the VPN provider. In practice that gives you three things:
- Your ISP stops seeing your destinations. It sees an encrypted connection to one address. The Electronic Frontier Foundation notes that this is the core benefit: a VPN hides your browsing from your ISP and the local network.
- Sites see the VPN server’s IP, not yours. That weakens location tracking by IP and makes it harder to link your sessions together by address alone.
- Local networks see less. On café, airport or hotel Wi-Fi, other people on the network can’t read your connection metadata.
What a VPN does not do
This is where most advertising oversells.
- It doesn’t stop breaches. If a service you use is hacked, the VPN was never in the path of that data.
- It doesn’t make you anonymous. Logged-in accounts, cookies and browser fingerprinting still identify you. Sign in to a site through a VPN and the site still knows who you are.
- It doesn’t replace basic security. EFF lists stronger passwords, two-factor authentication, HTTPS-only mode, device encryption, software updates and encrypted DNS as higher-impact steps for most people.
- It moves trust to a new company. EFF is blunt on this point: your browsing is hidden from your ISP, but it’s all visible to the VPN provider. A VPN with weak privacy practices is worse than none.
Where a VPN fits
For an ordinary user, the sensible order is:
- Use a password manager and unique passwords, so a breach at one service doesn’t unlock others.
- Turn on two-factor authentication for email, banking and anything holding your identity.
- Keep devices and apps updated.
- Add a VPN if you regularly use networks you don’t control, or if you don’t want your ISP to build a record of your browsing.
If you go that route, check the provider before you pay. Look for a published definition of what is and isn’t logged, a stated jurisdiction, and whether the claims have been independently verified. A specific policy beats a vague one: Atomic VPN, for example, names connection timestamps, assigned IPs, per-user bandwidth and DNS queries as data it doesn’t keep. Whichever you pick, a VPN is one layer in this list, not a substitute for the first three.
The honest bottom line
Surveillance and leaks are separate threats, and no single product covers both. A VPN reduces what your ISP and local networks can learn about you. It does not repair the fact that more of your data sits in more databases each year.
The most useful habit is simple: assume some of your data will leak, make sure a leak at one place doesn’t compromise another, and reduce what third parties can observe about you in the meantime.
FAQ
Does a VPN protect me from data breaches? No. Breaches happen on the company’s servers, outside your connection.
Can a VPN stop my ISP from tracking me? It stops your ISP from seeing the sites you visit and the content of your traffic. The ISP still sees that you’re connected to the VPN, plus when and how much.
Is a free VPN safe? Not automatically. Any VPN provider can see your traffic, so how it earns money matters. Check the privacy policy before you trust it.
Is a VPN legal? In most countries, yes. Some restrict or ban them, so check local rules before you travel.
Do I still need antivirus or 2FA with a VPN? Yes. A VPN doesn’t protect against phishing, malware or reused passwords.