Alleged NordVPN Data Breach: Salesforce Database and Source Code Reportedly Exposed

A threat actor operating under the alias 1011 has allegedly leaked sensitive internal databases belonging to NordVPN, one of the world’s most prominent virtual private network providers.

The leak, posted on a popular dark web hacking forum on Sunday, January 4, 2026, claims to expose critical development infrastructure, including Salesforce API keys, Jira tokens, and over 10 database source codes.

The actor asserts that the breach was not achieved through a sophisticated zero-day exploit, but rather by brute-forcing a misconfigured development server.

According to the forum post, the leaked dataset contains a MySQL dump of the compromised development server. The threat actor provided sample screenshots showing SQL commands used to export tables such as salesforce_api_step_details and api_keys.

The leak allegedly includes:

• 10+ Database Source Codes: Full schema definitions and stored procedures from the development environment.
• Salesforce API Keys: Authentication tokens that could allow programmatic access to NordVPN’s Salesforce CRM instance.
• Jira Tokens: Credentials used for accessing NordVPN’s internal issue tracking and project management systems.
• Additional Sensitive Information: Internal configuration files and development notes.

The actor’s post explicitly states: “This information was acquired by bruteforcing a misconfigured server of Nordvpn, which has salesforce and jira information stored.”

This server reported a treasure trove of internal credentials and schema data that could potentially allow further access into NordVPN operational environments.

Technical Analysis

The exposure of API keys and development tokens poses a significant secondary risk. While the breach appears limited to a development server, dev environments often mirror production settings or, critically, contain valid credentials for production services.

Asset Type	Potential Security Impact
Salesforce API Keys	Attackers could potentially access customer records, support tickets, and sales data stored in the CRM.
Jira Tokens	Exposure of internal software bugs, future feature roadmaps, and unpatched vulnerability discussions.
DB Source Codes	Allows threat actors to study the database structure (schema) to craft targeted SQL injection attacks against the production environment.

The presence of the salesforce_api_step_details table suggests the server was used to test integrations between NordVPN’s backend and their CRM.

If the API keys found in the dump are live production keys (a common developer mistake), the impact could extend far beyond the development sandbox.

Industry Implications

NordVPN, operating under the jurisdiction of Panama, has built its reputation on strict no-logs policies and robust security. However, this incident highlights a pervasive industry challenge: Shadow IT and unmanaged development assets.

Development servers are frequent targets for threat actors because they often lack the rigorous monitoring and multifactor authentication (MFA) enforcement applied to production systems.

If verified, this breach mirrors the 2018 incident where an insecure remote management system on a Finnish server was compromised.

At the time of this report, NordVPN has not issued an official statement confirming the validity of the data. Security researchers advise customers to remain vigilant against phishing attempts, as leaked CRM data is often weaponized for social engineering.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.