NordVPN confirms it found out a few months ago that one of its datacenters was hacked in March 2018, leaving it vulnerable to man-in-the-middle attacks
Need I say more? Be safe. 🤗🖖 https://twitter.com/... @nordvpn : @zackwhittaker Hi, our service has not been hacked. None of the information available on the one server can be used to impersonate or decrypt the traffic of any other. This was an isolated case of one datacenter. Please refer to our article for more accurate information https://nordvpn.com/... Undefined / @hexdefined : For those of you wanting a source: https://twitter.com/... Apparently it's “been floating around mostly unnoticed”, so I don't know where it's originally from. Here's the cert that matches the private key: https://crt.sh/... With the cert + key you can verify for yourself Undefined / @hexdefined : OpenVPN keys were leaked as well as the expired *.nordvpn.com TLS cert. I haven't researched enough about OpenVPN to know if it's using forward secrecy, though you'd hope so William Turton / @williamturton : Nord VPN says it one of its servers was compromised in 2018, and that hackers stole an expired TLS key, that “couldn't possibly have been used to decrypt the VPN traffic of any other server.” https://nordvpn.com/... Will Strafach / @chronic : oof, their rationale for delaying disclosure sounds like “we had no idea about IPMI access on other servers” if they found out only “a few months ago” they should explain how they found out, as that would indicate they did not find out through any internal monitoring system. pic.twitter.com/QSSmVUTLfA Kenn White / @kennwhite : “The attacker gained access to the server...by exploiting an insecure remote management system left by the datacenter provider, which NordVPN said they were unaware that such a system existed.” https://twitter.com/...
Context & Ripple Effects
NordVPN has confirmed that attackers accessed a single server in one of its datacenters back in March 2018 by exploiting an insecure remote management system left behind by the datacenter provider — walking away with an expired TLS certificate and OpenVPN keys that created a theoretical man-in-the-middle opening. The company insists the incident was isolated and that nothing on the compromised machine can impersonate or decrypt traffic elsewhere.
The awkward part is timing: the breach happened over a year before the public conversation, and NordVPN learned of it only months ago, with the details surfacing largely unnoticed among researchers first. That puts the story squarely in a lineage that includes the OneLogin compromise, where a security product itself became the attack surface and users had to be told which data center's customers were exposed.
First-order effects
- NordVPN's own users now have to weigh whether a stolen expired certificate and OpenVPN keys could enable interception of their sessions, while the company simultaneously fights the narrative that 'the service' — not just one box — was hacked.
Second-order effects
- Rivals in the consumer VPN market will be pushed toward published audits and faster breach disclosure, because the competitive differentiator shifts from features to verifiable operational security once one major provider's infrastructure story unravels publicly.
Third-order effects
- If the pattern holds across trust-centric products — OneLogin for password management, NordVPN here, and later the LastPass cloud-storage breaches where employee-held keys unlocked customer vaults — the industry moves toward independent attestation of infrastructure and third-party access as a purchase requirement rather than marketing.
The trend: Security products whose entire pitch is trust are increasingly breached through their own operational infrastructure, forcing the category toward audits, tighter vendor access control, and earlier disclosure.