>It just seems like an extraordinary claim

what? it's not extraordinary at all. mullvad has a long history of being very security conscious. they do not wait for american politicians to direct their security work. i will stress again, mullvad is a swedish company.

feel free to read the co-founder's HN comment right here: https://news.ycombinator.com/item?id=48145679. they found out about the issue via the blog post, looked into it, and fixed it. end of story. (it says as much in the first line of mullvad's blog post too...)