That’s the only place to start, not only because it was a public debacle, but also because it was a situation rife with misunderstandings. Like most VPN services, NordVPN does not own all of its servers. Some smaller VPN providers do, but just about every large VPN service rents at least some of the servers it uses.
At a data center in Finland, one of Nord’s servers was breached, and the company attributes that breach to improper configuration on the part of the data center provider. Regardless, no user account credentials were compromised, and the breach showed that NordVPN doesn’t keep logs, true to its privacy policy. It’s easy to be skeptical of a company’s word, but I’d like to contrast NordVPN’s breach with the public breach of LastPass. The fallout of LastPass’ breach is still rippling to this day, and it’s responsible for millions of dollars in losses. There’s been no evidence of monetary losses related to NordVPN’s breach in the past six years.
A breach is never a good sign, regardless of the circumstances, but the important thing is how NordVPN acted (and continues to act) in light of its breach. Not only was it transparent immediately, but it also put a security plan into action that we’ve seen play out. That included co-located servers, which NordVPN fully owns and operates, and disk-less servers, where logs literally can’t be stored because there’s no hard drive to store them on. There was also a security audit, and NordVPN has gone through an audit annually since its breach, with the latest arriving in February of 2025.
Beyond the basics, NordVPN includes additional security features. You get NordPass, which ranks among the best password managers, and Threat Protection. The Basic plan includes Threat Protection, which is limited. It can block ads and steer you away from sketchy websites, but there are plenty of free browser extensions that accomplish the same thing. Threat Protection Pro is only included with Plus and above, but it does a lot more. It can scan your PC for malware similar to an antivirus program, and it comes with a URL cleaner to strip out tracking information when clicking links.
One of my favorite new additions isn’t on the desktop app, though. NordVPN recently introduced scam call protection on Android, with an iOS version planned for the future. I’ve been using it for months, and it has easily flagged more than a hundred spam calls to my phone. It works a treat, even if it’s not one of NordVPN’s big advertised features.
Almost the Fastest VPN
NordVPN is fast. It’s not the fastest VPN I’ve tested—that’s Proton VPN—but that’s more of a rounding error than a notable difference in speed. Across five US locations, NordVPN dropped 15.32 percent of my unprotected speed on average. For context, Proton dropped 15.23 percent. Surfshark, which is also owned by Nord Security, dropped 18.84 percent, while Mullvad closed in on 24 percent.
So, NordVPN is fast, but more importantly, it’s consistent. Across the locations I tested, it never posted a slowdown of more than 20 percent, and in one location (Chicago), it only dropped a meager 6.6 percent of my unprotected speed. Overall, though, that 15 percent drop is a good representation of the speeds you can expect, at least in the US.