Yesterday, on the 4th of January, we have identified a data dump on one of the breach forum websites, containing allegations made by a threat actor claiming to have accessed a "NordVPN Salesforce development server." We immediately started to verify these claims and now want to address them directly to clarify what happened.

Our security team has completed an initial forensic analysis of the alleged data dump. While we are continuing our investigation to ensure absolute certainty, we can confirm that, at this stage, there are no signs that NordVPN servers or internal production infrastructure have been compromised.