Surfshark Says Misconfigured Internal Servers Exposed Build Credentials and Configurations

Summary

Surfshark says unauthorized access to internet-exposed internal test and proxy servers exposed build credentials, configurations, and system binaries. It reports no impact to customer data or production VPN systems and has rotated credentials and revoked tokens.

Key points

• A configuration error exposed an internal engineering test server to the internet, enabling unauthorized access.
• The exposed environment contained build-related credentials, service configurations, portions of system binaries, and code history; Surfshark did not specify the exact files or credentials.
• A separate server used as a content-accessibility proxy was also accessed.
• Surfshark said customer data, VPN traffic, production infrastructure, and apps were unaffected, with no evidence of credential misuse or spread to other systems.
• Surfshark detected suspicious activity on August 31, contained the incident on September 2, and completed remediation three days later.
• The company rotated potentially affected internal credentials, revoked exposed tokens, and said it strengthened monitoring, build-credential management, and security controls for test environments.

Vendors