An Objective Look at the NordVPN Server Breach
Last week, the internet blew up with the news regarding the NordVPN server breach that occurred in March of last year. The company immediately addressed the problem and issued a statement that no customer data was affected or stolen. With that being the case, we didn’t want to get deeper into the subject, but one thing prompted us to address this occurrence.
In the days that followed this news, several media outlets and NordVPN itself tried to put a positive spin on this, saying that it only helped the company to strengthen its security and provide a better service. But, there are many reasons why last year’s NordVPN server breach is more serious than it’s presented to be in public. And, in this week’s Zlog post, we will go over the biggest ones.
A More Detailed Look at the NordVPN Server Breach
NordVPN, a VPN provider that operates in more than 60 countries around the globe, with several thousand servers in total, became one of the first major VPN services to suffer a breach of this nature when a hacker attack occurred on their Finland server, managed by one of NordVPN’s partners. As reported by independent sources, the breach was a result of hackers exploiting an insecure remote-management system that was installed on the NordVPN-leased Finish server. According to NordVPN, they weren’t aware of this flaw, as their partner hasn’t informed them of any new updates they were performing on the Finish-based server.
There is another side to the story most readers haven’t been informed on. While this part of the issue isn’t talked about that much, the consequences of the breach could have had catastrophic proportions. This is because the hackers managed to get a hold of the secret crypto keys, including a digital certificate that provided HTTPS encryption for NordVPN. At the time of hijacking, the digital certificate was used to connect customers to the company’s web servers.
The server in question was taken down and effectively stopped existing, and the VPN severed its ties with the data center provider. But, certain actions that the company took didn’t go well with the online audience. Although NordVPN admitted to suffering a breach and did take certain measures, the fact that they didn’t reveal the name of the data center provider leaves a lot of room for further speculations and doesn’t help NordVPN’s attempts to turn this into a positive publicity outcome.
A Long-kept Secret
Let’s put the issue of the breach itself aside and take a look at another morally dubious decision NordVPN decided to make regarding this problem. Why didn’t NordVPN disclose this for more than a year and a half? In their statement, the provider said that it learned in March of 2018 about the intrusion. This poses the question of whether the provider would have shared the details of the breach in the first place if it weren’t for outside pressure from informed VPN users.
It also brings to mind another potential issue – were there any other server breaches NordVPN isn’t yet ready to share with the public? While their statement helped ease the minds of a lot of their customers, more serious VPN enthusiasts should still take NordVPN’s services and transparency policy with a grain of salt.
What Should NordVPN Users Do?
We can’t precisely know all of the details of the breach until more information comes out to the open. With that in line, it’s hard to advise NordVPN subscribers what to do going into the future. At the bare minimum, NordVPN customers and other VPN users should press this VPN service to share more details, as we don’t know all of the information and possible damage regarding this NordVPN server breach.
One thing is certain, with such a serious server breach occurring to one of the most widely-marketed VPNs out there, now more than ever, crucial to choose a safe and reliable VPN service. NordVPN took a massive reputation hit and tried to downplay the entire incident by putting a positive spin on it. It’s highly likely that they will see a significant drop in subscribers, with more people opting for more trustworthy VPN services.
Yaroslav S.CEO at ZoogVPN. Yaroslav is a versatile manager with extensive customer support experience. His historical background and a deep passion for philosophy perfectly complete a real desire to create meaningful content and tech products.
