NVIDIA Data Breach (2022): What Was Exposed & What To Do

In February 2022, NVIDIA experienced a data breach that exposed employee email addresses and password hashes belonging to approximately 71,000 individuals. The incident was reported on February 23, 2022, and involved the circulation of cracked credentials within hacking communities. The event drew attention because it affected a leading semiconductor company and involved the exposure of internal authentication data.

What happened

In February 2022, NVIDIA suffered a data breach that exposed employee credentials and proprietary code. Impacted data included over 70,000 employee email addresses and NTLM password hashes, many of which were subsequently cracked and circulated within the hacking community. The group lapsus$ claims responsibility through a leak-site listing. Specific details on the intrusion method, exact timing of access, and full scope of any additional files remain undisclosed in public reporting.

Who is lapsus$?

Lapsus$ is a threat actor group known for targeting large technology and telecommunications organizations. Public records show the group has previously claimed access to corporate networks through social-engineering tactics and credential theft, followed by public postings of stolen material. Its operations have been documented across multiple incidents involving source code and internal documents. In this case, the listing of NVIDIA on an associated site constitutes a claim by the group rather than a confirmed attribution from independent forensic sources.

About NVIDIA

NVIDIA designs and manufactures graphics processing units, system-on-chip products, and related software used across consumer, enterprise, and data-center markets. Organizations of this type routinely maintain large volumes of employee records, authentication systems, and proprietary engineering materials. A breach at such a firm can affect both internal operations and downstream supply chains that rely on its hardware and drivers.

What was likely exposed

The facts name email addresses and passwords, specifically over 70,000 employee email addresses and NTLM password hashes. Proprietary code is also referenced in the reported summary. The precise contents of any additional files, the number of cracked hashes that remain in active use, and whether further categories of data were obtained are not confirmed in the available information.

Why it matters

Exposed email addresses combined with cracked password hashes increase the chance of credential reuse against other services. For the organization, the release of proprietary code can create competitive or security disadvantages that persist beyond the initial disclosure. Individuals whose credentials appeared in the data face elevated risk of account takeover until passwords are changed and multi-factor authentication is enforced.

If your data was in this breach

Change passwords for any affected NVIDIA accounts and for any other services where the same credentials may have been used. Enable multi-factor authentication wherever available. Review account activity for signs of unauthorized access. Readers can run a free exposure scan of their email address against known breach data to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.