The VPN provider says a misconfigured internal test server gave outsiders engineering material and build credentials.