NordVPN has denied claims that hackers breached its internal Salesforce development servers, saying recently leaked data came from a temporary third-party testing environment and did not include real customer or business information.<\/p>\n
The clarification follows posts on a cybercrime forum over the weekend by a threat actor using the handle \u201c1011,\u201d claiming to have stolen more than 10 databases from a NordVPN development server. The attacker alleged the data was obtained by brute-forcing a misconfigured system and included sensitive assets such as Salesforce API keys, Jira tokens, and other development-related information.<\/p>\n
The post quickly gained attention on breach forums and social media, particularly because it referenced tools commonly used in internal development and customer support workflows. However, NordVPN says the claims are inaccurate.<\/p>\n
What NordVPN Says Happened<\/strong><\/p>\n According to the company, its security team reviewed the leaked files and conducted an initial forensic analysis. NordVPN said it found no evidence that its servers or internal production infrastructure, or customer data, have been compromised.<\/p>\n Instead, NordVPN says the leaked files originated from a trial account on a third-party automated testing platform created roughly six months ago while the company was evaluating a potential vendor for automated testing.<\/p>\n \u201cAs part of a standard Proof of Concept (PoC) phase, a temporary test environment was created to assess their functionality,\u201d NordVPN explained in a blog post published on Monday.<\/p>\n \u201cBecause this was a preliminary test and no contract was ever signed, no real customer data, production source code, or active sensitive credentials were ever uploaded to this environment.\u201d<\/p>\n The company added that the test setup was never connected to NordVPN\u2019s core infrastructure and was fully isolated from production systems. The databases reportedly contained only dummy data used to check functionality.<\/p>\n \u201cThe leaked elements, such as the specific API tables and database schemas can only be artifacts of an isolated third-party test environment, containing only dummy data used for functionality checks,\u201d NordVPN said. \u201cNo data in the dump points to NordVPN.\u201d<\/p>\n The company says it is continuing to investigate the matter\u00a0and has contacted the third-party vendor for additional information about how the test environment was accessed and to ensure similar exposures do not occur in the future.<\/p>\n NordVPN assured users that its systems remain secure and require no action from its users.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" NordVPN has denied claims that hackers breached its internal Salesforce development servers, saying recently leaked data came from a temporary third-party testing environment and did not include real customer or business information. The clarification follows posts on a cybercrime forum over the weekend by a threat actor using the handle \u201c1011,\u201d claiming to have stolen […]<\/p>\n","protected":false},"author":20,"featured_media":128298,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3141,7],"tags":[1541,531,4878,1510,64815,16301,11318,64814],"class_list":{"0":"post-128296","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-security-news","9":"tag-breach","10":"tag-data-breach-2","11":"tag-data-leak","12":"tag-dummy","13":"tag-jira-tokens","14":"tag-nordvpn","15":"tag-salesforce","16":"tag-salesforce-api-keys"},"yoast_head":"\n