Surfshark reports breach of an internal testing and proxy server

Surfshark, a well-known VPN provider, has disclosed a security incident: unknown actors gained access to one of its internal testing servers. The cause was human error — a misconfiguration left a machine intended for engineering teams reachable from the internet.

What was compromised

According to the company, the vulnerable server held service configurations, credentials tied to application builds, and fragments of system binaries and code history. Surfshark did not, however, specify which binaries, settings, services, tokens or files were exposed.

The attackers also reached a separate server responsible for optimizing content access. This machine operated as a proxy and, as the company stresses, had no access to sensitive data — user identifiers, IP addresses, encryption keys or traffic.

Customers are safe, the company assures

Surfshark insists that the incident did not affect its production VPN infrastructure or customer data. The company points out that no personal data was stored on the breached server, that traffic and browsing history are not logged in the first place, and that the apps and browser extensions on users' devices were not altered in any way.

Suspicious activity was detected on August 31, the incident was contained on September 2, and three days later the remediation was completed. The company found no evidence that the exposed credentials had been used by anyone or that the breach had spread to other systems.

Measures taken

In response to the incident, Surfshark rotated all potentially affected internal credentials, revoked the exposed tokens, and stepped up monitoring and threat detection. In addition, the company pledged to extend production-level protection to its testing environments, improve credential management during the build process, and commission an independent audit of its infrastructure.

According to Surfshark, users are not required to take any action to protect their accounts. Nevertheless, staying alert to suspicious activity and unexpected messages is still recommended. The company promised to share further details if the investigation uncovers anything significant.

Source: Bleeping Computer