Nowadays, most of the people are using VPN or Virtual Private Network services to protect their online privacy and browse the internet anonymously. But, what will happen to internet privacy of the VPN users when the VPN servers get hacked? Yes, this has happened with NordVPN, who has claimed that one of its servers was hacked back in March 2018.
NordVPN is one of the most popular VPNs used and has millions of users across the globe. The company has blamed an expired internal security key for the breach that took place. According to the company, one of the data centres located in Finland was accessed in an unauthorized manner. The hacker exploited an insecure remote management system deployed by the data centre provider to break into the server. Interestingly, this system was completely new to NordVPN prior to the breach as reported by the company.
However, NordVPN has clearly stated that server which was hacked did not contain any data. In addition to this, the company said that there is not even a single way to use an expired private key to decrypt the VPN traffic on its other servers.
It is to be noted that NordVPN does not log user data which means that credentials were also not risked when the server was breached. However, an evil-minded person could do a tailor-made man-in-the-middle attack for a single connection accessing the NordVPN.
According to the popular tech blog TechCrunch, NordVPN is not only VPN provider which was hacked last year. It is suggested that TorGuard and VikingVPN were also hacked.
NordVPN being late in acknowledging the server breach that happened last year stated that they wanted to be 100% sure that each component within their infrastructure is secured before making any announcement regarding the breach.
I think it’s better to be safe than sorry. Most people think that the announcement regarding the breach came too late but in my opinion, it’s only natural for the service to check its other servers before making it public. Also, claiming it was “hacked” is a bit too much, especially when the VPN itself was not hacked