Comment by zirgs

If they sell data then it's possible to buy that data. So a security researcher could simply try buying that data and then expose that VPN provider.