A virtual private network that markets its \u201cadvanced security\u201d said on Monday that one of its services had been compromised last year.<\/p>\n
Nord VPN, which is based in Panama, said on the company\u2019s website that it discovered the breach a few months ago at a data center in Finland. The company\u2019s statement comes after allegations on Twitter by security researchers alleging Nord had been hacked.<\/p>\n
Tom Okman, a Nord advisory board member, said the hackers only had access to a single \u201cexit node,\u201d the part of the service that masks its customers\u2019 IP address, and not its internal databases. The hackers appeared to have access for about two months, he said. Okman was made available for an interview by the company.<\/p>\n
The breach was done by \u201cexploiting a vulnerability of one of our server providers, which hadn\u2019t been disclosed to us,\u201d according to the company\u2019s statement. \u201cNo user credentials have been intercepted. No other server on our network has been affected. The affected server does not exist anymore and the contract with the server provider has been terminated.\u201d<\/p>\n
Nord VPN has 12 million users worldwide, according to spokeswoman Laura Tyrell, but she said the company estimates only 50 to 200 customers used the breached server. VPN services anonymize internet activity by routing traffic through servers that mask a user\u2019s identity and location.<\/p>\n
Okman said it was hard to determine if hackers obtained information on the internet usage of Nord users because the company doesn\u2019t collect logs of activity on its servers, a selling-point to privacy-conscious customers. \u201cI think that the worst case scenario is that they could inspect the traffic and see what kind of websites you could visit,\u201d Okman said. He said this would only apply to Nord users who used its Finnish server and were accessing websites that didn\u2019t use the secure protocol HTTPS.<\/p>\n
Okman said Nord was slow to inform its users of the 2018 breach because it wanted to verify that none of its 5,000 different servers had the same issue. That process is still ongoing, he said. \u201cWe would rather not disclose this now but due to the concerns of our users we had to do this now,\u201d Okman said. Nord plans to inform its customers of the breach via email.<\/p>\n
The announcement touched off a dispute over who was to blame.<\/p>\n
Okman said the breach was the fault of Nord\u2019s data center provider, a Finnish company called Oy Creanova Hosting Solutions Ltd., which he accused of having \u201cvery bad security practices.\u201d Creanova introduced software that led to hackers gaining access without Nord\u2019s knowledge, Tyrell said.<\/p>\n
But Niko Viskari, Creanova\u2019s chief executive officer, blamed Nord for the breach. \u201cThey had a problem with security but because they do not take care of security by themselves,\u201d he said, in an email. Nord, he said, was trying \u201cto put this on our shoulders.\u201d<\/p>\n
For Nord, security is a key selling point. In a tweet from August, Nord claimed the service would protect its users from hackers. \u201cHackers would love to grab your sensitive data right out of your screen,\u201d the tweet says. \u201cAnd they can — unless you encrypt your traffic with NordVPN.\u201d<\/p>\n
A virtual private network that markets its \u201cadvanced security\u201d said on Monday that one of its services had been compromised last year.<\/p>\n","protected":false},"author":341034,"featured_media":270111,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[61486],"class_list":["post-324324","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-nord-vpn"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/324324"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/341034"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=324324"}],"version-history":[{"count":0,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/324324\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/270111"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=324324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=324324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=324324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}