According to the company, the misconfigured server was reachable from the public internet due to an error in its setup. Once inside, the attackers moved to a proxy server. Surfshark has not released specific details about how long the access lasted or exactly what data, if any, was viewed.

Key points from the disclosure:

• A configuration error exposed an internal test server to the internet.
• Attackers accessed that test server and a proxy server.
• The breach did not affect the core VPN service or customer accounts, per Surfshark.
• No specific CVE ID or advisory number has been provided in the report.

Users and administrators should watch for any follow-up guidance from Surfshark, especially if they operate their own proxy or test infrastructure that might be similarly exposed. As always, keep internal testing environments off the public internet unless absolutely necessary, and audit configurations regularly.

Source: Unknown

Has your organization reviewed whether any internal test or proxy servers are inadvertently exposed to the internet?