'no User Data Affected' — Surfshark Reveals Details Of September's Security Incident

• Surfshark confirms an unauthorized third party accessed an internal server
• No user data or browsing traffic was compromised
• The firm has committed to a new independent security audit

Surfshark has published a detailed incident report regarding a security breach that occurred in early September 2026, confirming that an internal test server was accessed by an unauthorized third party.

If you rely on the best VPN to protect your online privacy, the provider was quick to reassure users that its live production systems remained completely secure. According to the official disclosure, "no user data and VPN services were affected" during the incident.

The breach was ultimately traced back to a human error that left an internal engineering test server misconfigured and exposed to the public internet. Through this server, the unauthorized party accessed limited internal engineering materials, including system binaries and internal configurations.

Crucially, Surfshark emphasized that personal information "was never held and accessible from here," and customer VPN traffic is never logged in the first place.

Speaking to TechRadar, Patricija Cerniauskaite, Head of Communications at Surfshark, reiterated that the compromised system was kept completely separate from live production systems.

"By design, it does not store or process any user data," Cerniauskaite explained. "While the incident does not affect our customers, we take it very seriously and believe that being open about security is an important part of earning customer trust. We remain committed to protecting our customers' privacy and security."

How Surfshark responded to the breach

According to Surfshark's official incident timeline, the first signs of unusual activity were detected on August 31. Because the alerts originated from an isolated test environment that held no sensitive data, the company initially handled it as a lower-risk case rather than triggering its most urgent protocols.

However, once the full scope was confirmed on September 2, Surfshark immediately contained the incident, backed up the affected server, and disconnected its external connections.

The provider noted that the unauthorized actor also gained access to an isolated content accessibility optimization server, which acted purely as a proxy with no access to user IP addresses or encryption keys.

"Although none of these credentials provided access to user data or to the production systems that serve our users, we reviewed the available access logs, and while no malicious activity was detected, as a precaution, we rotated or retired every secret we identified," Surfshark explained in its blog post.

Complete infrastructure remediation and secret rotation were finalized by September 5.

The incident highlights the ongoing challenges of securing internal testing infrastructure, a gap Surfshark openly acknowledged. The provider now confirms the intention of raising its test and experimental environments to the exact same security standards as its live production systems.

To further harden its security posture, Surfshark then vows to improve access controls and credential management throughout its build process. It will also enhance the detection and monitoring of its testing infrastructure to ensure internal servers are never accidentally exposed to the internet again.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

???? Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

A commitment to transparency

Surfshark has built a strong reputation for maintaining customer trust, often working alongside the security community to validate its services.

Independent auditors confirm Surfshark's VPN infrastructure as secure on a regular basis. The provider also regularly backs up its no-log claims with third-party audits.

Because the service is fundamentally designed not to retain or monitor browsing activity, incidents involving isolated test servers are far less likely to result in catastrophic user data leaks.

That said, following this incident, Cerniauskaite told TechRadar that the team is currently selecting an independent cybersecurity firm to conduct a new broad infrastructure audit.

She also confirmed other third-party assessments are ongoing, including an audit of Dausos, its proprietary protocol.