Key Facts
Surfshark says an unauthorized party accessed an internal engineering test server after it was misconfigured to be reachable from the internet. The company says its investigation found no effect on user data or VPN services.
Technical Details
According to Surfshark, the exposed environment contained limited engineering material, including parts of system binaries, internal configurations, and build-related credentials in code history. It says an isolated content-accessibility proxy was also accessed, but that neither system had access to user identities, IP addresses, encryption keys, or browsing traffic.
Impact & Mitigation
Surfshark says it contained the incident, removed the exposure, and rotated or retired identified secrets. It also reports additional detection, monitoring, credential-management, and hardening measures, plus an independent security audit. Organizations should apply equivalent controls to test environments and remove unintended internet exposure.