There's a reason the privacy community doesn't recommend NordVPN. Here's why. NordVPN markets "Panama jurisdiction" for privacy. The documented reality is more complicated. Corporate structure: Co-founders Tomas Okmanas and Eimantas Sabaliauskas also founded Tesonet, a Lithuanian startup accelerator. Court documents from Luminati v. Tesonet explicitly identified "Tesonet's VPN service called NordVPN." Operations center on Vilnius, Lithuania (EU jurisdiction). Parent company Nord Security is Netherlands-registered. Panama holds the trademark. Tesonet's portfolio includes Oxylabs, a major proxy and web scraping service. Data extraction business under the same roof as a privacy VPN. 2018 breach: Server in Finland compromised via exposed iLO remote management. Attacker got root access, TLS keys, OpenVPN CA key. Disclosed October 2019 only after @hexdefined forced it on Twitter. 19-month delay. They knew for over a year and said nothing while millions of users routed traffic through a compromised server. Kenn White (Open Crypto Audit Project): "The Nord VPN not-a-hacker had full remote admin on their Finland node LXC containers. That's God Mode folks. And they didn't log and didn't detect it." From their own privacy policy: A/B price testing data collection admitted. Billing data retained 10 years. AppsFlyer for marketing/analytics. Device identifiers for "marketing or analytics purposes." Regulatory pressure: UK ASA ruled ads misleading twice (2019, 2023). First for exaggerating WiFi threats, second for "switch off malware" claim. Multiple US class actions allege deceptive auto-renewal and charging 14 days early. Affiliate ecosystem: When every "unbiased" review ranks them #1, follow the money. Nord offers 100% commission on first-month signups, 40% on longer plans. You're reading ads, not reviews.