This is difficult to track, as it is really just a sentence attached to some screenshots, with some commentary but no technical detail... but this seem to be a

This is difficult to track, as it is really just a sentence attached to some screenshots, with some commentary but no technical detail... but this seem to be a website key, not an OpenVPN key? (edit: And, in fact, this is confirmed by NordVPN's statements on the matter: "The expired TLS key was taken at the same time the datacenter was exploited. However, the key couldn’t possibly have been used to decrypt the VPN traffic of any other server. On the same note, the only possible way to abuse website traffic was by performing a personalized and complicated MiTM attack to intercept a single connection that tried to access nordvpn.com.")