Loading story…
NVIDIA confirmed that personal information belonging to GeForce NOW users in Armenia was exposed after a breach at GFN.am, its regional alliance partner operating the service locally. GFN.am said attackers gained unauthorized access to a backend database between March and late March, with the intrusion reportedly first detected on May 2 and publicly disclosed on May 5. NVIDIA said its own network and NVIDIA-operated services were not affected, and no confirmed impact outside Armenia has been reported.
The exposed data may include names, email addresses, phone numbers, dates of birth, and platform usernames, including full names for some users who signed in with Google and phone numbers for some who registered through a mobile operator. GFN.am said passwords were not compromised, but the breach followed claims by ShinyHunters, which allegedly advertised millions of GeForce NOW records for sale for $100,000 in cryptocurrency on a hacker forum. The company said it has fixed the root cause and added security controls, while affected users face heightened risks of phishing, SIM-swapping, and other social-engineering attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-08, NVIDIA confirmed that user information was exposed in a breach affecting GFN.am-operated systems in Armenia, while stating NVIDIA-operated services and its own network were not impacted. NVIDIA said impacted users would be notified by GFN.am and no confirmed impact beyond Armenia had been reported.
Following the disclosure, threat actor ShinyHunters allegedly posted on a hacker forum claiming to have stolen millions of GeForce NOW records and offered the database for sale for $100,000 in Bitcoin or Monero.
On 2026-05-05, GFN.am disclosed a breach involving unauthorized access to its backend database and said passwords were not compromised. The company also said it remediated the root cause and implemented additional organizational and technical security controls.
GFN.am said it first detected the unauthorized access on 2026-05-02 after an exposure window of roughly 54 days.
NVIDIA later described the breach as affecting systems operated by its Armenian alliance partner GFN.am between 2026-03-20 and 2026-03-26. Exposed data included names, email addresses, phone numbers in some cases, dates of birth, and usernames.
GFN.am said an intrusion affecting its backend database started on 2026-03-09, creating a period during which GeForce NOW Armenia user data may have been accessed or exfiltrated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcegfn.am
Open sourcegfn.am
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nvidia said a cyberattack exposed employee credentials and proprietary data after the extortion group **Lapsus$** claimed it had breached the company’s corporate network and stolen more than **1TB** of information. Reports said the stolen material included schematics, firmware and driver source code, and a leak of usernames and cryptographic password hashes for **71,335 employees**. The group also issued an unusual extortion demand, threatening further leaks unless Nvidia removed its **Lite Hash Rate (LHR)** restrictions from GeForce RTX 30-series graphics cards. The fallout expanded beyond the initial intrusion as attackers began using **stolen Nvidia code-signing certificates** to sign malware and malicious Windows drivers, including tools such as **Cobalt Strike**, **Mimikatz**, backdoors, RATs, and a Quasar sample. Researchers warned that even expired certificates could still allow signed drivers to load in Windows, complicating defenses and raising the risk of broader downstream abuse. The incident unfolded amid wider concern over high-profile intrusions linked to Lapsus$, including a separate breach that prompted **Ubisoft** to order a company-wide password reset.
Jun 29, 2026
Armenian authorities opened an investigation after a threat actor using the alias **dk0m** advertised for sale a dataset allegedly containing nearly **8 million** government-related records tied to a state notification system used to distribute official legal and administrative communications. The data was marketed on an underground forum for **$2,500** and was described as including notifications and communications associated with police and judicial bodies; officials in Yerevan publicly denied that the country’s **government email infrastructure** had been breached while acknowledging the possibility that another state platform was accessed. Armenia’s Public Relations and Information Center (PRIC) said a preliminary review indicates the leaked material may have originated from the **electronic civil litigation** platform, and that an internal probe is ongoing to confirm the source and access path. Researchers at **CyberHUB-AM** assessed dk0m as a recurring data broker active since at least 2024 and reported the actor commonly uses **infostealer malware** to harvest credentials/session data and identify access to sensitive government portals before repackaging and reselling datasets; screenshots reportedly dating to **August 2024** were cited as supporting evidence. The alleged exposure could increase **social engineering** risk by enabling highly credible scams referencing real case numbers, fines, or enforcement actions.
Jun 29, 2026
Glendale Community College disclosed a data breach after it was reportedly targeted in a **ShinyHunters** "pay or leak" extortion campaign, with stolen information later published online. Reporting on the incident says the exposed dataset contained **793,925 compromised accounts** and nearly **800,000 unique email addresses**, making it a large-scale exposure affecting students and other individuals tied to the college. The leaked information reportedly included names, physical addresses, phone numbers, dates of birth, **Social Security numbers**, government-issued identification details, gender, academic records, and student enrollment-related data. The college said the exact data exposed may vary by individual, but the breadth of the breach raises immediate risks of phishing, identity theft, fraud, and account takeover attempts against affected people.
Jul 15, 2026