Surfshark's 9 September 2026 incident report says unusual activity on an internal engineering test server was confirmed on 2 September 2026 after a human misconfiguration left the host reachable from the internet. The company contained the same day and finished remediation by 5 September. An unauthorised party accessed limited engineering material (parts of system binaries, internal service configurations, and some build-related credentials that had appeared in code history).

Access was also gained to an isolated content-accessibility optimisation VPS used as a proxy with no user identities, IP addresses, encryption keys, or browsing traffic.

Surfshark states no user data or production VPN services were affected, no customer action is required, and exposed secrets were rotated or retired. (sources: Surfshark blog incident report; BleepingComputer)

Updated 10 Sep 2026 (BleepingComputer): BleepingComputer's report is dated 10 September 2026; details credited to BleepingComputer on this card come from that report.