Surfshark Confirms Unauthorised Access to Internal Engineering Systems

Surfshark has disclosed a cybersecurity incident involving unauthorised access to an internal engineering environment. The company stated that the incident did not affect user data or its VPN services.

The security breach was first discovered on 31 August 2026. Following an investigation, the VPN and cybersecurity provider confirmed the scope of the incident on 2 September, prompting immediate containment and remediation efforts.

Misconfigured Test Server Exposed Data

The incident was traced back to a misconfigured internal test server that became accessible from the internet. According to the company, the server contained limited engineering material, including internal service configurations and parts of system binaries.

Threat actors also accessed an isolated content accessibility optimisation server, which functions as a virtual private server (VPS) proxy. Surfshark noted that no encryption keys, user identities, IP addresses, or browser traffic were exposed during this access.

Credential Rotation and Remediation

During the investigation, Surfshark identified internal, build-related credentials that had been committed to its code history. The company has since rotated these credentials to prevent further risk. Surfshark maintained that these credentials did not provide access to production systems or user-facing data.

The company emphasised that the affected systems were part of an internal engineering environment designed to be separate from the production infrastructure that delivers its services. Surfshark also noted that it does not log or retain VPN traffic or browsing activity.

In response to the breach, Surfshark has removed the exposure, implemented additional security measures, and announced plans to undergo an independent security audit to evaluate the security posture of its wider infrastructure.