SECURITY INCIDENTS / 2018-03
NordVPN’s 2018 Finland server incident, disclosed in 2019
One third-party-hosted server in Finland
NordVPNCompany marks identify the subjects discussed, not a finding or endorsement. Image sources.
Labels identify the source, not a security rating or independent StealthVPN testing. Read the document scope and limits.
What the record says
NordVPN’s October 2019 response dates unauthorized access to a Finland server to March 2018, and says it learned of it in April 2019.
NordVPN: response and timeline for the Finland breach (opens in a new tab)
Data outcome and relevance
The company reports stolen TLS keys, no affected user credentials and no signs of traffic monitoring. Its report says the server contained no activity logs.
NordVPN: response and timeline for the Finland breach (opens in a new tab)
Company response or subsequent action
NordVPN says it terminated the hosting relationship and began a broader service audit.
NordVPN: response and timeline for the Finland breach (opens in a new tab)
What remains unestablished
A provider incident account is not an independent reconstruction. A historical key exposure is different from a court-ordered production of logs; absence of reported monitoring is not proof that every possible impact was excluded.
Sources and document locators
- Provider incident disclosureNordVPN: response and timeline for the Finland breach (opens in a new tab)
October 21, 2019; timeline and key facts
A selected, dated case file. It does not replace reviewing the current service, policies and infrastructure. How we investigate