The attackers would have also been able to see the user DNS lookups, giving away the user browsing data and defeating the purpose of using a VPN altogether.ДЄlthough NordVPN has not released any evidence of malicious activity, they have launched a deeper investigation into their infrastructure. NordVPN has claimed the stolen key wouldnвЂ™t have been able to decrypt traffic on other servers. This knowledge would have given them the ability to tamper with the traffic by sniffing it directly or modulating it by injecting malicious traffic. This tactic would allow them to perform a Man-in-the-Middle (MITM) attack, spoofing the user.Д«ased on the information we know, the attackers could have had insights into the insecure HTTP traffic flowing through the breached servers. If a cyber-criminal takes possession of these private keys, they can generate their own server certificate and/or keys to create a fake VPN service mimicking the real ones. The details of the VikingVPN breach have yet to be confirmed by the company. The company has confirmed they were practicing secure PKI management and the main CA key wasnвЂ™t stored in the compromised server. TorGuard only had a single server compromised. NordVPN has since terminated the contract with the owner of the compromised servers. The attackers were able to gain root access of the VPNвЂ™s servers.ДЄn expired private key from one of NordVPNвЂ™s Finland-based servers was stolen and published online by an attacker, exposing user data.

NordVPN, TorGuard, and VikingVPN were breached early in 2018.

Torguard status