Surfshark VPN says hackers breached internal testing, proxy servers

Surfshark disclosed that a misconfigured internal test server was exposed to the internet and accessed by an unauthorized party, revealing service configurations, build-related credentials, portions of system binaries, and code history. The vendor says production VPN infrastructure and customer data were not affected, detected the activity on August 31, contained it on September 2, rotated impacted credentials, revoked tokens, hardened systems, and commissioned an independent audit while finding no evidence of credential misuse or lateral spread.