The reporting doesn’t say Proton “literally unmasked a user to the FBI.” What happened is that Proton was legally compelled by Swiss authorities to provide payment data they already had, and those authorities later shared it with the FBI through a legal assistance treaty.

The email content remained encrypted. What identified the user was the credit-card payment tied to the account, which is inherently traceable.

The uncomfortable reality is that people often deanonymize themselves: they create accounts without Tor, pay with identifiable cards, and link real-world data to the account. At that point the provider doesn’t need to “break” anything — the identifying information already exists.

Half true.

This post is about VPN. And Proton VPN is still safe.

Your info/news is on Proton Mail. In this case Proton was legally obliged (Swiss law) to give out identifying data for the owner of a known email address. The owner used a credit card and they had to give up the credit card info. The content and communications inside their email account is still private and was not given out. If they had used cash or crypto for paying, proton might have had no information to give out to the authorities. And again, they were obliged by law.