Data Breaches

Surfshark Systems Targeted by Hackers

A misconfigured test server containing engineering material, including internal configurations, was accessed by threat actors.

Ionut Arghire

Published

6 hours ago

VPN attack

VPN and cybersecurity services provider Surfshark this week disclosed a cybersecurity incident impacting certain internal data.

The incident, it says, was discovered on August 31, but initially treated as low risk. By September 2, however, the company confirmed the scope and moved to containment and remediation.

An internal test server that became accessible from the internet after being misconfigured was accessed by a threat actor, Surfshark explains in an incident report.

The server contained limited internal engineering material, including “parts of the system binaries and internal configurations for certain services,” Surfshark said.

Surfshark also identified internal, build-related credentials that had been committed to its code history and rotated them, although they did not provide access to user data or production systems serving users.

Additionally, the hackers accessed an isolated content accessibility optimization server (VPS) used as a proxy. However, no encryption keys, user identities, IP addresses, or browser traffic were exposed.

Advertisement. Scroll to continue reading.

“Based on our investigation, we have confirmed that no user data and VPN services were affected,” the company said.

“The system involved was an internal engineering environment. By design, it does not store or process any user data, and it is kept separate from the production systems that deliver our service,” it added.

The company also pointed out that it does not log or retain VPN traffic and browsing activity and that no application or browser extension running on users’ devices was altered.

In response to the incident, the company contained the affected system and removed the exposure, rotated the relevant internal credentials, implemented additional security measures, and confirmed the full scope of the compromise.

“We will also execute an additional independent security audit to evaluate the security posture of the broader infrastructure environment,” Surfshark said.