Surfshark Says Misconfigured Internal Test Server Was Accessed
Summary
Surfshark said an internet-accessible, misconfigured internal test server was accessed, exposing limited engineering materials. The company reported no user data or VPN services were affected and said it contained the system and rotated credentials.
Key points
- Surfshark said it discovered the incident on August 31 and confirmed its scope by September 2.
- A misconfigured internal test server became accessible from the internet and was accessed by a threat actor.
- The server held limited engineering materials, including parts of system binaries and internal service configurations.
- Build-related credentials found in code history were rotated; Surfshark said they did not provide access to user data or production systems.
- An isolated content accessibility optimization proxy server was also accessed, but Surfshark said encryption keys, user identities, IP addresses, and browser traffic were not exposed.
- Surfshark said no user data or VPN services were affected, and no user-facing application or browser extension was altered.
- The company said it contained the affected system, removed the exposure, added security measures, and will conduct an independent security audit.
Article Details
- Victim Organization
- Surfshark
- Incident Type
- Unauthorized access to an internet-accessible internal test server caused by misconfiguration, and access to an isolated content accessibility optimization server used as a proxy.
- Data Types Exposed
- Limited internal engineering material, including parts of system binaries and internal service configurations
- Internal build-related credentials were identified in code history and rotated; the article does not state that these credentials were exposed from the accessed server
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Surfshark reported that no user data or VPN services were affected. It contained the affected system, removed the exposure, rotated relevant credentials, and implemented additional security measures.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed