Surfshark says an internet-reachable engineering test server was accessed by an unauthorised party. It reports no user-data or VPN-service impact, but the incident exposed an important security gap.