Controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile5 entries
2023
United Kingdom advertising ruling on malware claims
The UK Advertising Standards Authority ruled against an advertisement suggesting that NordVPN could switch off malware. The regulator found that listeners could understand the claim as a promise to stop all malware, which NordVPN had not substantiated.
2019
Credential-stuffing exposure
A separate report said approximately 2,000 NordVPN usernames and passwords had been exposed through credential stuffing. The incident was distinct from the Finland server breach.
2019
United Kingdom advertising ruling on public Wi-Fi claims
The UK Advertising Standards Authority advised NordVPN not to repeat advertising that portrayed public Wi-Fi as effectively equivalent to handing personal information to nearby people. The regulator said the advertising overstated the risk because HTTPS already provides significant protection.
2019
NordVPN discloses a breach of one server
Issue disclosure
NordVPN confirmed that one of its servers had been breached in March 2018 and said it had known about the attack for months without informing customers. A security researcher had reported that private data, including an expired private key, was publicly accessible. NordVPN acknowledged shortcomings in its handling of server security and described security audits and a bug bounty program as steps it was taking or preparing.
Company response
Remediation — NordVPN
We are taking all the necessary means to enhance our security. We have undergone an application security audit, are working on a second no-logs audit right now, and are preparing a bug bounty program.
Refund or compensation — NordVPN
NordVPN has indicated that refunds will be available for anyone who wishes to cancel their service in the wake of the breach.
Source excerpt
A security researcher posted a Twitter thread which revealed that private data from NordVPN were publicly accessible, including a copy of a since-expired private key which could have been used between the breach and expiry to decrypt private communications or perform man-in-the-middle attacks and which could still be used today to decrypt previously-captured historical traffic - but only, the company claims, on the one specifically-breached server.
Virtual private network (VPN) provider NordVPN has confirmed that one of its servers was breached back in March 2018, and that it had known of the attack since 'a few months ago' - but had not passed that information on top its customers.
We failed by contracting an unreliable server provider and should have done better to ensure the security of our customers,
2018
Finland server breach and delayed disclosure
A vulnerability in a contracted data center's remote administration system enabled unauthorized access to a NordVPN server in Finland. NordVPN said the incident did not expose user credentials, billing information, or other profile data and found no evidence of an actual man-in-the-middle attack. Critics nevertheless objected that the breach was not disclosed promptly after the company learned of it.