NordVPN Denies Breach After Hacker Leaks Data

NordVPN denied suffering a breach after a threat actor claimed to have obtained data from its systems, with the firm stating that initial forensic work has found no evidence of its servers or internal production infrastructure being compromised. The hacker claimed on 4 January on BreachForums that they had acquired source code from a “NordVPN development server,” and NordVPN’s response on 5 January emphasised that the leaked data does not originate from its Salesforce environment or any other internal system.

Instead, the company said the data appears to come from a third‑party automated testing platform evaluated six months ago, during a trial period that created a temporary environment not connected to production. No real customer data, source code, or credentials were uploaded, and the firm added that claims of breached internal Salesforce development servers are false, noting the isolated test environment contained only dummy data. According to NordVPN, while the probe continues, there is no evidence of a production‑level breach.