VPN and cybersecurity services provider Surfshark this week disclosed a cybersecurity incident impacting certain internal data.
The incident, it says, was discovered on August 31, but initially treated as low risk. By September 2, however, the company confirmed the scope and moved to containment and remediation.
An internal test server that became accessible from the internet after being misconfigured was accessed by a threat actor, Surfshark explains in an incident report.
The server contained limited internal engineering material, including “parts of the system binaries and internal configurations for certain services,” Surfshark said.
Surfshark also identified internal, build-related credentials that had been committed to its code history and rotated them, although they did not provide access to user data or production systems serving users.
Additionally, the hackers accessed an isolated content accessibility optimization server (VPS) used as a proxy. However, no encryption keys, user identities, IP addresses, or browser traffic were exposed.
“Based on our investigation, we have confirmed that no user data and VPN services were affected,” the company said.