Surfshark VPN reports breach of internal test and proxy servers due to misconfiguration

Internal Test Server Compromised

Surfshark reported that one of its internal test servers was breached by hackers. The incident occurred because a human error led to the server being misconfigured, making it accessible from the internet. This exposed service configurations, build-related credentials, portions of system binaries, and code history.

Proxy Server Access and Data Impact

In addition to the test server, an unauthorized party also accessed a separate server used for content-accessibility optimization, which functioned as a proxy. Surfshark confirmed that this proxy server did not store sensitive data such as user identity, IP addresses, encryption keys, or browsing traffic. The company emphasized that production VPN infrastructure and customer data remained unaffected.

Incident Detection and Remediation

Surfshark detected suspicious activity on August 31 and contained the incident by September 2. The remediation process was completed three days later. The company found no evidence that the exposed credentials were misused or that the compromise spread to other systems.

Security Enhancements Implemented

Following the breach, Surfshark rotated all potentially impacted internal credentials and revoked exposed tokens. The company also implemented additional threat detection, activity monitoring, and system hardening measures. These include applying production-level security controls to test environments, improving build-process credential management, and commissioning an independent audit of its broader infrastructure. Surfshark stated that users do not need to take any action to protect their accounts.