NordVPN is interesting because it was less about them handing over data to the government, and them just not being transparent about an attack. All the others in that post clearly were in cahoots with big gov.

NordVPN’s defense was technically coherent: because the company doesn’t store activity logs, no user browsing data was exposed. The breach was framed as a vendor problem. The attacker had gotten in through an insecure remote management system that the data center had left open. NordVPN said it hadn’t even known the system existed.

That may all be accurate. But the eighteen months of silence is the actual story.