The problem with NordVPN isn't that they had a breach and their keys were leaked (ok, well that is huge fucking problem) due to a forgotten KVM but that they didn't fess up till 18 months later when some independent researcher brought that to light.