Hacker claims to have leaked NordVPN's Salesforce data

A threat actor operating under the alias 1011 is publicly claiming to have obtained and leaked sensitive data from NordVPN 's development infrastructure via dark web forums.

See also: NordVPN's NordWhisper bypasses networks that block VPNs

According to reports, the breach includes more than ten database source codes, as well as critical authentication credentials, which could pose serious risks to the VPN company's operational security.

The attacker claims that access was gained through a misconfigured development server hosted in Panama, highlighting the perennial weakness of poorly secured development environments in the tech industry.

According to the initial disclosure, the compromised data includes NordVPN core system source code repositories, Salesforce API keys, and Jira tokens.

See also: NordLayer adds malware detection tool

These credentials provide direct access to critical business tools used for customer relationship management and project monitoring.

The threat actor also published sample SQL dump files, which reveal the structure of sensitive database tables — such as the salesforce_api_step_details table and the api_keys settings — confirming access to NordVPN's backend infrastructure.

Dark Web Informer analysts spotted the leak after the threat actor posted evidence on underground forums on January 4, 2026 .

See also: NordVPN Meshnet: Now offered for free to everyone!

Researchers noted that this incident highlights how development servers are often attractive targets due to their more lax security settings compared to production environments.