VPN provider Surfshark has disclosed a security incident in which attackers accessed one of its internal test servers after a human configuration error left the machine reachable from the public internet. The compromised server was used by engineering teams for testing and contained service configurations, build-related credentials, system binaries, and code history. A second server used for content-accessibility optimization (a proxy) was also accessed.
The impact on customers appears limited: Surfshark says the breached environments had no access to user identities, IP addresses, encryption keys, or browsing traffic. The company has closed the exposure and found no evidence of broader access to its infrastructure. Still, build credentials and internal configurations reaching outside parties is a meaningful incident for any security software vendor — it’s the kind of access that could inform future, more targeted attacks if not fully contained. Surfshark says it has rotated the affected credentials and is reviewing its internal security procedures.
Sources
- Surfshark VPN says hackers breached internal testing, proxy servers — BleepingComputer