Nitro gonitro.com Nitro data breach: what happened and what to do
Nitro, the PDF software maker, had a breach in September 2020 that exposed 77,159,696 accounts in Have I Been Pwned. Email addresses, names and bcrypt password hashes were exposed, plus the titles of converted documents.
View all 13,115 breaches- Breach date
- 28 Sept 2020
- Affected
- 77,159,696
- Data exposed
- Email addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Nitro makes PDF editing and conversion software. In September 2020 its service suffered a breach that, per Have I Been Pwned, exposed 77,159,696 accounts, over 70 million of them unique email addresses.
What happened
A database was offered for sale not long after the breach, reportedly for $80,000, and a copy was later leaked for free in January 2021, according to TechRadar and UpGuard. Nitro had first called it a "low impact security incident" and said no customer data was affected. The leaked database showed otherwise.
What was exposed
Email addresses, names, bcrypt password hashes and the titles of converted documents, plus company names and other account details. bcrypt is a slow hashing method, which makes cracking harder than with older schemes, but weak passwords still fall.
What that means for you
The mix matters. Nitro was used in workplaces, so many of the email addresses are work addresses, and document titles can reveal what a person was working on. That gives a scammer material for a convincing phishing email aimed at you or your employer, such as a fake document share. Anyone who cracks a weak password can try it on other accounts.
What to do if you were in it
- 1
Change your Nitro password and anywhere you reused it
The passwords were stored as bcrypt hashes, which attackers can crack, especially weak ones. Pick a new, unique password for Nitro and for any other account that shared it. A password manager makes that painless.
- 2
Turn on two-factor authentication
Use an authenticator app or a passkey on your email, banking and shopping accounts. A leaked password then isn't enough to log in.
- 3
Watch for fake document links
Be careful with unexpected PDF, invoice or file-share emails, especially ones that mention your company. Open them from the sender's real site, not from the email link.
- 4
Expect phishing that mentions Nitro
Names, emails and phone numbers let scammers write believable messages. Treat unexpected emails and texts that mention Nitro or your orders with suspicion, and go to the site directly instead of clicking links.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you hear about the next one early. It can't remove data from a breach, so the alert is the useful part.
Frequently asked
Was I affected by the Nitro breach?
Check your email address on Have I Been Pwned. 77,159,696 accounts are listed.
What was exposed?
Email addresses, names and bcrypt password hashes, plus document titles and company names.
Should I change my password?
Yes, for Nitro and for any account that used the same password.
Did Nitro confirm the breach?
Nitro first described a low impact security incident with no customer data affected. The leaked database later showed user records.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
