[user764743]

If you have access to court records in the netherlands, look up the case of the Dutch KPN blackmailer from a few years ago. He got caught because he used NordVPN instead of only using Tor. NordVPN gave everything they had on him, which led to his conviction.

As a rule, if a VPN is hosted in Europe/North America, you need to assume that they log.

edit: my source is from this talk at BalCCon, unfortunately the video is not available. https://2k19.balccon.org/events/278.html

[RonMarken]

I was under the impression the KPN attacker merely used a single-hop VPN service from his KPN connection and the investigators managed to correlate traffic-flows.

Unfortunate that talk is not publicly available.