NordVPN, a provider of virtual private network (VPN) services, confirmed the hacking of one of its servers in a data center that occurred in March 2018.
According to the company, the attacker gained access to the data center server in Finland by exploiting an unsecured remote management system left by the data center provider. Moreover, NordVPN claims it was unaware of the existence of this system.
"The server itself did not contain any logs of user activity; none of our applications send user-created credentials for authentication, so usernames and passwords could not be intercepted as well," the company stated in its official announcement.
NordVPN did not disclose the name of the data center provider but stated that it terminated its contract with the owner servers and ceased using their services. The company reported that it learned of the breach several months ago, but did not disclose the circumstances until it was assured that the rest of its infrastructure was fully secure.
The company confirmed that it had implemented an early breach detection system, although, according to its representative, "no one could have known about the undisclosed remote management system left by the provider (of the data center)."
Source: 3dnews.ru
