Missing from the story: did they reach out to Mullvad? Would have been interesting to see how their security team responded.

As far as I can tell they did not, and I've asked both our operations and support teams. I will update this post if I am mistaken.

Edit: In hindsight I regret making this comment. It was unnecessary, but removing it now would look weird.