NordVPN Hack Claim Firmly Refuted by NordVPN

NordVPN’s alleged security breach claims were firmly refuted, with the attacker using the name 1011 claiming on 4 January to have brute-forced a misconfigured NordVPN development server and to have provided sample SQL dumps and screenshots. According to Forbes, NordVPN was quick to investigate and posted a security update within 24 hours. The data allegedly obtained did not originate from NordVPN’s development environment or any systems the hacker claimed to be affiliated with.

Instead, the servers brute-forced by the threat actor appeared to belong to a third-party platform that was under assessment during a trial account period, which never progressed and led to the selection of a different vendor. The development environment was never connected to NordVPN production systems, undermining the credibility of the breach claim. The piece serves as a reminder to verify claims carefully before reporting or repeating them.