A misconfigured internal test server at Surfshark, accessible from the internet, was accessed by threat actors. The server contained limited internal engineering materials such as system binaries and internal configurations, as well as build-related credentials committed to code history. The credentials were rotated after discovery. An isolated proxy server was also accessed, but no sensitive user data, encryption keys, or VPN traffic were exposed. The affected system was separate from production environments and did not process or store user data. Surfshark contained the incident promptly and implemented additional security measures.

No user data, VPN service data, encryption keys, user identities, IP addresses, or browser traffic were exposed or compromised. The incident affected only internal engineering environments and isolated proxy servers, which do not handle production or user data. There was no impact on Surfshark's VPN services or user privacy.

Surfshark contained the affected system, removed the exposure, rotated the relevant internal credentials, and implemented additional security controls. An independent security audit is planned to assess the broader infrastructure security posture. No further user action is required as no user data or production systems were affected.