Cyber Incident Victim: NVIDIA Corporation
Date:
Feb 2022
Location:
United States of America
Summary
A major technology company experienced a cybersecurity breach where attackers infiltrated its network, compromising proprietary information and employee credentials. The intrusion was claimed by the Lapsus$ extortion group, which leaked approximately 20GB of stolen data—including password hashes—from a purported 1TB cache. The victim confirmed no ransomware deployment or connection to geopolitical conflicts but acknowledged unauthorized data exfiltration. Internal teams and external cybersecurity experts strengthened network defenses, initiated forensic analysis, and collaborated with law enforcement. While sensitive data was accessed, the incident did not disrupt business operations or customer services.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 23, 2022, NVIDIA detected a cybersecurity incident impacting its IT resources. The company responded by hardening its network, engaging cybersecurity incident response experts, and notifying law enforcement. Shortly after the breach became public, the extortion group Lapsus$ claimed responsibility, asserting they had stolen approximately 1TB of proprietary NVIDIA data and employee credentials. The group began leaking information online, including password hashes allegedly belonging to employees and a 20GB archive purportedly extracted from the stolen data cache. NVIDIA confirmed unauthorized access had occurred, acknowledging the theft of proprietary information and employee credentials but found no evidence of ransomware deployment or any connection to the Russia-Ukraine conflict. The incident initially caused system outages, though NVIDIA did not specify the duration or operational scope beyond IT resource impacts.
NVIDIA’s security team worked to analyze the leaked data to assess the full extent of the compromise. The company stated the breach was not expected to disrupt business operations or customer service capabilities. Lapsus$’s public disclosures escalated concerns about potential exploitation of the stolen credentials and intellectual property, though NVIDIA did not detail specific systems or datasets affected beyond confirming proprietary information was accessed. No customer data breaches were mentioned in NVIDIA’s public statements. The company reiterated its commitment to security as an ongoing priority, emphasizing investments in protective measures and product integrity. Law enforcement involvement remained active, but no further details regarding investigations or threat actor attribution were provided.