"We can disclose only now that we had a server in Toronto seized in 2015, initially without our knowledge. Maybe a court order was served to the datacenter. For about 10 days we did not understand what happened to the server, which did not respond, while the datacenter did not provide information. After 10 days Italian police (and not any magistrate) contacted us. They informed us that Toronto police and FBI (*) asked for our help because they could not find any log in the server. Unfortunately their help request came after the server had been already seized. They did not even make a copy, they took it physically, therefore the server went offline, probably alerting the alleged criminals. It was obvious that forensic analysis could not find any log, simply because there were none. Our VPN servers did not even store the client certificates, go figure (now they also run in RAM disks, but in 2015 they did not). The whole matter was led by informing us without any document from any court or magistrate, but only through official and informal police communications, and only to ask for help after forensic analysis obviously failed completely.
We were not asked to keep confidentiality on the matter, but just to stay on the safe side and support the investigation on what it appeared as a serious crime (a whole database with personal information of a commercial service was cracked, stolen and published in public when the web site owners did not pay a "ransom"; while our server was apparently not used for the crack, it was used to upload elsewhere the database) we decided not to disclose the whole matter for at least 7 years. It's one of those cases confirming that our servers do not store log, data or metadata of clients' traffic.
(*) We may speculate that FBI was involved in a Canadian matter because the stolen database contained US citizens' personal data"
What else has happened in the 7 years that they haven't bothered to mention? Absolutely NOT handled well as timely disclosure is a key part of that.
Exactly that. I don't use that service but the past 7 years could have seen dozens of other events like this with less harmless outcome, and its clear they would not report these either.
Especially the way they snake around why they didnt disclose it. "We can only disclose now". Why? They made it clear they didn't receive a court order or anything that would prevent them. They specifically mention that it was only an informal phone call from a police department.