Loading story…
Surfshark disclosed that attackers accessed an internal test server that had been accidentally exposed to the internet through a configuration error. The exposed environment contained service configurations, software-build credentials, system binaries, portions of a source-code repository, and access to a separate content-access optimization proxy server. Suspicious activity was detected on August 31; Surfshark contained the incident on September 2 and completed primary remediation three days later.
The company said it found no evidence that the exposed credentials were used or that the attackers laterally moved into its internal infrastructure, production environment, or customer systems. Surfshark rotated potentially affected internal credentials, revoked compromised tokens, and increased monitoring; it also plans to extend production-grade protections to test systems, revise build-credential management, and commission an independent infrastructure audit.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
Three days after containment, Surfshark completed its main remediation work, including rotating potentially exposed internal credentials, revoking compromised tokens, and increasing monitoring and threat detection.
Surfshark contained the incident after detecting the unauthorized activity on its exposed test environment.
Surfshark detected suspicious activity associated with the unauthorized access and began investigating the incident.
Following the intrusion, Surfshark said it plans to conduct an additional independent security audit of its broader infrastructure environment.
A configuration error exposed an internal Surfshark engineering test server to the internet, allowing attackers to access service configurations, software-build credentials, some binaries, and source-code repository fragments. The attackers also accessed a separate content-access optimization proxy server, which Surfshark said held no user data, IP addresses, encryption keys, or traffic information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
4 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcexakep.ru
Open sourcecyberveille.ch
Open sourcesurfshark.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SailPoint disclosed that attackers gained unauthorized access to a subset of its GitHub repositories after exploiting a vulnerability in a third-party application. The company said it detected the activity on April 20, contained the intrusion, terminated the unauthorized access, and remediated the underlying issue. In an SEC `8-K` filing and public statements, SailPoint said its investigation, supported by an external incident response firm, found no evidence that customer data in production or staging environments was accessed and no service disruption occurred; the company also said it directly notified affected customers and does not currently require further customer action. The company did not specify which repositories were affected or what information may have been exposed, leaving open questions about whether source code, configuration data, secrets, or architectural details were accessed. Outside experts said repository access can provide valuable reconnaissance for future identity-focused supply chain attacks, noting that the full impact of similar breaches at firms such as Okta, LastPass, and CircleCI only became clearer over time.
Jun 29, 2026
A threat actor identified as 1011 claimed to have breached NordVPN’s development infrastructure, leaking over ten database source codes, Salesforce API keys, and Jira tokens on a dark web forum. The attacker alleged that access was gained via a misconfigured development server in Panama, and released sample SQL dump files as proof, exposing the structure of sensitive backend database tables. Security researchers noted that the incident highlights the risks associated with poorly secured development environments, as the leaked credentials could potentially enable further attacks against NordVPN’s business tools and ecosystem. NordVPN responded by denying that any sensitive internal systems were compromised, stating that the data originated from a temporary test environment used during a vendor evaluation for automated testing. According to NordVPN, the environment was isolated, contained only dummy data, and was never connected to production systems or real customer information. The company emphasized that no actual customer or business data was exposed, and that the threat actor’s claims were based on non-sensitive, non-production artifacts. The incident underscores the importance of securing all environments, including those used for testing and vendor trials, to prevent reputational and operational risks from similar claims.
Jun 29, 2026
CrowdSec disclosed that a backdoored TanStack dependency was used in May to extract an API key with read access to its private repositories, resulting in the unauthorized copying of source code from roughly 300 repositories. The exposed material included code for its SaaS console, AWS Cloud routines, connectors, and automations; more than 130 affected repositories containing the open-source CrowdSec Security Engine were already public. The company was notified of the incident on September 16 and said it found no evidence that customer data, customer logs, or credentials enabling lateral movement were compromised. CrowdSec rotated affected API tokens and other credentials, increased monitoring, and began reviewing its code and systems for potential backdoors linked to the supply-chain compromise.
Sep 21, 2026