Surfshark VPN: Hacker Attack on Internal Servers

Surfshark VPN announced a security incident on September 12, 2026, in which hackers were able to access an internal test server of the company. The incident was caused by a configuration error that inadvertently made the server accessible to the internet. Surfshark stated that the security vulnerability was quickly identified and resolved. The affected servers were part of Surfshark's internal testing environment used for developing and testing new features.

According to company statements, no sensitive user data or payment information was compromised. The company's security measures prevented critical data from falling into the hands of the attackers. Surfshark promptly reported the incidents to the relevant authorities and is working closely with them to determine the causes of the attack. The company has also engaged external security experts to verify the integrity of its systems and to close any future security gaps. The vulnerability was classified as critical as it allowed attackers to access internal test data.

However, Surfshark emphasized that the attackers did not gain access to the production environment or end-user data. The company has informed its customers about the incident and assured them that all necessary measures have been taken to ensure the security of its services. Surfshark's statement noted that the incident had no impact on the availability of VPN services. Users were able to maintain their connections without interruption. Surfshark has also reviewed and updated its security protocols to prevent similar incidents in the future.

The company's response to the incident demonstrates that Surfshark is taking proactive measures to ensure data security. The company has encouraged its customers to review their own security practices and ensure they use strong passwords and regularly update their account information. Surfshark has conducted several security audits in the past and continuously invests in improving its security infrastructure. The current incident is seen as an opportunity to further enhance security standards and strengthen user trust. The vulnerability that led to this incident is internally classified as CVE-2026-XXXX, with the exact number yet to be determined.

Surfshark plans to publish the results of the security review in the coming weeks to create transparency and strengthen user trust. The company has announced that it will continue to work closely with security authorities to fully understand and assess the impact of the incident. Surfshark has also emphasized that the security of user data is a top priority and that all necessary steps will be taken to protect it. The incidents highlight the challenges companies face in the field of cybersecurity. Surfshark is committed to continuously improving security standards and keeping users informed of all developments. The complete investigation of the incident is expected to be concluded in the coming weeks, and Surfshark plans to make the results publicly available.