Surfshark VPN
Sep 2026 · Graded Attested · Technology and Software · Beyond the filings
Incident summary
Surfshark VPNSep 2026
Not yet quantified
AAttestedAn internet-facing test server, left reachable by misconfiguration, gave an intruder a way into Surfshark's engineering environment sometime before August 31. From there, the attacker reached an isolated proxy VPS and found build credentials sitting exposed in the code history. Surfshark says no encryption keys, user identities, or VPN traffic were touched.
Technology and Software
Surfshark VPN says hackers breached internal testing, proxy servers
Initial attack type exposed or misconfigured system confirmed · Impact data theft inferred
About this record
This incident is beyond the filings: attributed to a company statement, a regulator or court record, or a news report, and graded Attested or Inferred. Every figure links to the source it was read from; if we have read one wrong, tell us at info@hackerinahoodie.com. This index never sums figures across incidents. See the methodology.