Surfshark VPN Confirms Hackers Breached Internal Testing and Proxy Server Infrastructure

Summary

Surfshark has confirmed that attackers breached internal testing systems and proxy server infrastructure. The company disclosed the incident on September 11, 2026, stating that internal testing environments and proxy servers were accessed without authorization. Surfshark said user VPN traffic was not affected and that the breach was contained to internal infrastructure. The scope of what was accessed or exfiltrated from the breached systems has not been fully disclosed as of this bulletin. The breach is under ongoing investigation.

Timeline

What Happened

Surfshark confirmed unauthorized access to internal testing systems and proxy servers. The company said its VPN tunnels and user traffic were not affected, framing the incident as limited to backend infrastructure rather than the core VPN service. Internal testing environments and proxy servers can contain configuration data, internal credentials, network topology details, and test account information, but Surfshark has not specified what data, if any, was accessed or exfiltrated.

The disclosure is limited at this stage. Surfshark has not named a threat actor, disclosed an attack vector, or provided a timeline of when the breach occurred relative to discovery. The company describes the incident as contained. This bulletin will require updating as the investigation produces additional confirmed facts.

Domain Intelligence

surfshark.com — 61.05

Score sits in the low-trust range. Surfshark is the breached organization. The score reflects surfshark.com's domain trust posture as assessed prior to and independently of this incident.