Police in Reykjavík have warned parents about a dangerous VPN profile used by over 300 children and adolescents, which allowed unknown parties to read and modify their internet traffic. The warning was first reported by Vísir.
According to police, the VPN was linked to a wider investigation into the sale of forged electronic identification documents to minors. One individual has been arrested on suspicion of selling fake IDs to hundreds of young people. Investigators disclosed that a smartphone app, designed to mimic the official island.is portal but not actually associated with it, was sold as part of this scheme.
Police identified a product called ‘Island Surge VPN’, which deceived users by changing the national ID displayed on the island.is platform and online banking sites. The VPN profile routed all internet traffic from the phones through servers controlled by the operator, facilitating a so-called ‘man-in-the-middle’ attack where data could be accessed or changed before reaching the device. To activate the VPN, users needed to install a security certificate named ‘Surge CA’ and mark it as trusted.
Young people purchasing the service had to provide their real national ID numbers and pay via Stripe, enabling the operator to collect real names, email addresses, photos and stated ages. Police urged retailers of age-restricted goods not to rely solely on the island.is website or app for verifying national IDs, but to demand traditional ID cards, such as a plastic name certificate, driving licence or passport.
Registers Iceland (Þjóðskrá Íslands) issues secure plastic name certificates (nafnskírteini) for personal identification.
Police have provided step-by-step instructions for parents and guardians to check and remove the VPN from iPhones and iPads, including how to find profiles and certificate settings. They will also offer in-person assistance at the police station at Hverfisgata 113 in Reykjavík on Thursday, 15 October, between 11:00 and 12:00.
Background
Registers Iceland is the official government agency responsible for maintaining civil records in Iceland. It was established in 2010 from the merger of Þjóðskrá Íslands and Fasteignaskrá Íslands, and manages the main civil registry for the country.
Sources
Links: heimasíðu Þjóðskrár · pm-public.com · snerpa.is
- Vísir (first reported) in Icelandic
- Lögreglan (Icelandic Police) in Icelandic
- Bæjarins besta in Icelandic
