NordVPN denies breach claims, says attackers have "dummy data"

A threat actor claimed to have stolen more than 10 databases containing Salesforce API keys and Jira tokens from a NordVPN development server; NordVPN says the files are dummy data from a temporary third-party testing environment that was never connected to production and contained no real customer or business information. The story is presented as a false alarm, with the company contacting the vendor for more details and reference to a separate 2019 breach for historical context.