One of the most well-known VPN service providers, NordVPN, stated that the Finnish data centre provider, where the server was housed, was to blame for the security breach.
NordVPN was not aware that the provider of the data centre employed an unsecure remote administration method.
According to NordVPN, the stolen TLS key was no longer valid, making it impossible to decipher VPN communications.
According to NordVPN and TorGuard, no user credentials were captured, and no servers outside from the one in question were accessed.
"id": "NOR23117423",
"linkid": "nord-vpn",
"type": "Breach",
"date": "10/2019",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"