NordVPN nordvpn.com NordVPN data breach: what happened and what to do
A server NordVPN rented in a Finnish datacenter was accessed around March 2018. NordVPN says it learned of it in April 2019 and made it public in October 2019. It says the server held no user activity logs or login details, but an expired TLS key was taken.
View all 13,177 breaches- Breach date
- Mar 2018
- Made public
- 1 Oct 2019
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
NordVPN says one of its servers, located in a third-party datacenter in Finland, was accessed by an intruder around March 2018. According to the company, the datacenter had set up a remote-management account without NordVPN's knowledge, and that account was the way in. The datacenter removed the account in March 2018 without telling NordVPN. NordVPN says it only found out in April 2019 and took the server out of service that day. It published its account in October 2019.
Dates differ slightly between sources, so treat "around March 2018" as approximate. NordVPN's own post and SecurityBrief's report both describe a single affected server.
Sources checked: securitybrief.co.uk, consumer.ftc.gov, cisa.gov
Last verified against the official page:
What was exposed
NordVPN says the intruder did not find user activity logs and did not obtain user login details. It confirms the intruder got a TLS key for the server, one that had already expired. NordVPN argues that key could only support a narrow, targeted attack that needs prior access to a victim's device or network, and that it could not decrypt NordVPN traffic.
That is the company's own account. No independent audit of it is cited here. No count of affected customers is given, because NordVPN says no customer data was taken.
What it means for you
If the company's account is right, there is little for criminals to use against you: no passwords, no emails, no payment details. That still leaves the usual risk after any VPN or security brand makes headlines. Scammers copy the news into emails and texts that say your account was hacked and ask you to log in or pay. The FTC explains how to recognize phishing, and the habits it lists apply here.
The company's response
NordVPN shredded the affected server on the day it learned of the incident and says no other servers or datacenter providers it uses were affected.
What to do if you were in it
- 1
Don't click links in messages about this breach
Emails or texts claiming your VPN account was hacked are a common scam. Go to the company's site by typing the address yourself, as the FTC advises.
- 2
Turn on multi-factor authentication
Use it on your VPN account and your email. CISA recommends multi-factor authentication because it blocks most account takeovers even when a password is stolen.
- 3
Use a unique password
If you reuse your VPN password anywhere else, change it on every account. A password manager makes unique passwords easy.
- 4
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see if your details appear in known breaches. Serus monitors breach databases and the dark web and alerts you, but it can't remove breach data.
Timeline
-
The breach happened
-
The company made it public
Frequently asked
Was I affected by the NordVPN breach?
NordVPN says no customer data was taken, and that the server held no user activity logs. It did not report a number of affected customers.
What was exposed?
NordVPN says an intruder obtained an expired TLS key for one server. It says no passwords or login details were taken.
Should I change my NordVPN password?
NordVPN says login details weren't obtained, so a change isn't required by its account. Changing a reused password is still sensible, and the same goes for turning on multi-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
