In October 2024, NordVPN received a warrant from the Panamanian government to provide user data as part of a criminal investigation. NordVPN only disclosed payment-related information and confirmed the presence of an account associated with the provided email address, due to its no-logs policy. The incident highlights potential vulnerabilities in data privacy, despite strong security measures and the company's commitment to user privacy.

One of the most well-known VPN service providers, NordVPN, stated that the Finnish data centre provider, where the server was housed, was to blame for the security breach. NordVPN was not aware that the provider of the data centre employed an unsecure remote administration method. According to NordVPN, the stolen TLS key was no longer valid, making it impossible to decipher VPN communications. According to NordVPN and TorGuard, no user credentials were captured, and no servers outside from the one in question were accessed.

NordVPN were exposed to vulnerabilities that could have allowed hackers to execute arbitrary code with administrator privileges on computers running Windows. The bugs, CVE-2018-395 were discovered by Cisco Talos security researchers which is similar to another security flaw discovered in March by security consulting firm VerSprite. NordVPN had released patches to fix the original vulnerability. It was still possible to execute code as an administrator albeit through a exploit. The initial vulnerability was due to OpenVPN being able to select a malicious file when choosing a VPN configuration. They use OpenVPN's open-source software to set up secure connections from one point to another. The vulnerability had already been fixed.