: These accounts are rarely obtained through a direct breach of NordVPN itself. Instead, they are typically the result of credential stuffing —where hackers use passwords leaked from other site breaches to see if they work on NordVPN.

: Avoid reusing passwords across different platforms to prevent credential stuffing attacks from being successful.

: Accessing or using accounts from such a list is a violation of the Computer Fraud and Abuse Act (CFAA) or similar international laws.