NordVPN Data Breach 2019

NordVPN confirmed that a contracted Creanova datacenter server in Finland was breached in March 2018, resulting in theft of a TLS key and an OpenVPN CA key; although NordVPN says only one of roughly 3,000 servers was affected and no customer data was confirmed stolen, the keys could be used to create rogue VPN servers and intercept individual users. The company destroyed the affected server, terminated the contract, initiated audits, plans to move to diskless servers, engage penetration testers, and raise security standards for providers.