VPN firm that claims zero logs policy leaks 20 million user logs