Loading story…
Nvidia said a cyberattack exposed employee credentials and proprietary data after the extortion group Lapsus$ claimed it had breached the company’s corporate network and stolen more than 1TB of information. Reports said the stolen material included schematics, firmware and driver source code, and a leak of usernames and cryptographic password hashes for 71,335 employees. The group also issued an unusual extortion demand, threatening further leaks unless Nvidia removed its Lite Hash Rate (LHR) restrictions from GeForce RTX 30-series graphics cards.
The fallout expanded beyond the initial intrusion as attackers began using stolen Nvidia code-signing certificates to sign malware and malicious Windows drivers, including tools such as Cobalt Strike, Mimikatz, backdoors, RATs, and a Quasar sample. Researchers warned that even expired certificates could still allow signed drivers to load in Windows, complicating defenses and raising the risk of broader downstream abuse. The incident unfolded amid wider concern over high-profile intrusions linked to Lapsus$, including a separate breach that prompted Ubisoft to order a company-wide password reset.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Ubisoft disclosed a cyber incident that disrupted some games, systems, and services and prompted a company-wide password reset. Reporting linked the event to the same period in which Lapsus$ was targeting major technology companies including Nvidia and Samsung.
Researchers found threat actors using Nvidia code-signing certificates exposed in the breach to sign malware and malicious drivers, including Cobalt Strike beacons, Mimikatz, RATs, and a Windows driver. The abuse created ongoing risk because Windows could still load drivers signed with the expired certificates.
After Nvidia refused to negotiate, Lapsus$ leaked files including usernames and cryptographic hashes for 71,335 employees. The group also demanded that Nvidia remove Lite Hash Rate restrictions from GeForce RTX 30-series GPUs or face further leaks.
Nvidia confirmed that employee credentials and some proprietary information were taken during the cyberattack. This marked the company's public acknowledgment of data theft beyond the initial disclosure of the incident.
The extortion group Lapsus$ claimed responsibility for the Nvidia intrusion and said it stole more than 1TB of data from the company's corporate network. Reported stolen material included schematics, driver source code, firmware source code, and employee credential data.
Nvidia said it was investigating a cyberattack on its IT resources after threat actors breached parts of its business systems. The company later indicated the incident affected employee credentials and proprietary information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
siliconrepublic.com
Open sourcebleepingcomputer.com
Open sourcearstechnica.com
Open sourcepcmag.com
Open sourcezdnet.com
Open sourcebleepingcomputer.com
Open sourcebleepingcomputer.com
Open sourcethenationalnews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.K. police arrested seven people aged 16 to 21 over suspected links to **Lapsus$**, the extortion-focused hacking group tied to intrusions at **Microsoft, Nvidia, Samsung, Ubisoft, Okta,** and other major firms. Reporting identified a 16-year-old near Oxford as a suspected central figure, while investigators and journalists described the group as a loose set of mostly young operators who stole data, leaked source code and internal documents, and taunted victims publicly on Telegram and other platforms. Microsoft confirmed the group obtained source code through **limited access**, reinforcing the scale and credibility of the campaign. The activity continued to expand as **Globant** disclosed unauthorized access to a limited portion of its code repository after Lapsus$ leaked **70GB** of allegedly stolen data. The company said the exposed material appeared limited to certain source code and project documentation for a small number of clients, and that it had not found evidence of broader compromise. Coverage of the group highlighted that its operators often relied on comparatively simple but highly effective tactics—including **social engineering, SIM swapping, MFA fatigue attacks,** and attempts to bribe insiders—showing how basic intrusion methods enabled a string of high-profile breaches and data leaks.
Jun 29, 2026
NVIDIA confirmed that personal information belonging to GeForce NOW users in Armenia was exposed after a breach at **GFN.am**, its regional alliance partner operating the service locally. GFN.am said attackers gained unauthorized access to a backend database between March and late March, with the intrusion reportedly first detected on May 2 and publicly disclosed on May 5. NVIDIA said its own network and NVIDIA-operated services were not affected, and no confirmed impact outside Armenia has been reported. The exposed data may include **names, email addresses, phone numbers, dates of birth, and platform usernames**, including full names for some users who signed in with Google and phone numbers for some who registered through a mobile operator. GFN.am said **passwords were not compromised**, but the breach followed claims by **ShinyHunters**, which allegedly advertised millions of GeForce NOW records for sale for **$100,000** in cryptocurrency on a hacker forum. The company said it has fixed the root cause and added security controls, while affected users face heightened risks of phishing, SIM-swapping, and other social-engineering attacks.
Jun 29, 2026
NVIDIA issued security updates for multiple products across its AI and enterprise software stack, fixing vulnerabilities that could allow **remote code execution**, denial of service, privilege escalation, data tampering, and information disclosure. The most severe issue disclosed in its broader March advisories was `CVE-2025-33244` in **NVIDIA Apex**, a widely used PyTorch extension for mixed-precision and distributed training. High-severity flaws were also addressed in **Triton Inference Server**, **Megatron LM**, **NeMo Framework**, and **Model Optimizer**, with NVIDIA warning that exploitation could disrupt AI workloads, expose sensitive training data, or enable unauthorized access. Medium-severity issues were additionally listed in **VIRTIO-Net**, **SNAP4**, and **B300 MCU**. NVIDIA later released urgent fixes for **TensorRT-LLM** and **Isaac Launchable**, including TensorRT-LLM deserialization flaws in MPI server and RPC testing components that could lead to RCE, data manipulation, information disclosure, or service outages. It also patched a Linux issue in Isaac Launchable involving sensitive information sent in clear text, creating risks of privilege escalation and system disruption. NVIDIA advised customers to upgrade **TensorRT-LLM** to `1.2.1` or later, and said organizations running multi-GPU deployments should use: ```bash trtllm-llmapi-launch ``` to reduce network exposure. The company has also begun publishing PSIRT bulletins on GitHub in Markdown and CSAF formats to support automated vulnerability management and faster remediation.
Jun 29, 2026