We don’t know exactly what was stolen and how it affects VPN security. The breach happened nineteen months ago, but the company is only just disclosing it to the public.

TorGuard also said it learned of VPN breaches last May, “and in a related development we filed a legal complaint against NordVPN.” TorGuard officials said on Twitter that the private key was not on the affected server and that attackers “could do nothing with those keys.” Monday’s statement went on to say TorGuard didn’t remove the compromised server until early 2018. The stolen data related to a squid proxy certificate. The theft happened in a 2017 server breach. In a statement, TorGuard said a secret key for a transport layer security certificate for *. was stolen. The revelations came as evidence surfaced suggesting that two rival VPN services, TorGuard and VikingVPN, also experienced breaches that leaked encryption keys. The name of the third certificate suggested it could also have been used for many different sensitive purposes, including securing the server that was compromised in the breach. Those certificates might be issued for other servers in NordVPN’s network or for a variety of other sensitive purposes. There was a successful attack against NordVPN:īased on the command log, another of the leaked secret keys appeared to secure a private certificate authority that NordVPN used to issue digital certificates.

Nordvpn chromebook