NVIDIA nvidia.com NVIDIA data breach: what happened and what to do
In February 2022, NVIDIA had a cyberattack that exposed employee credentials and proprietary information. Have I Been Pwned lists 71,335 email addresses and password hashes, many later cracked and shared.
View all 13,115 breaches- Breach date
- 23 Feb 2022
- Affected
- 71,335
- Data exposed
- Email addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
NVIDIA confirmed in February 2022 that attackers had stolen employee credentials and some proprietary information from its network. The company dated its discovery to February 23, 2022. It said it hardened its network, brought in incident response experts and contacted law enforcement. NVIDIA said it had no evidence of ransomware and didn't expect its operations or customer service to be disrupted.
Have I Been Pwned lists 71,335 affected accounts. The exposed data includes employee email addresses and NTLM password hashes, many of which were cracked and passed around afterwards. NVIDIA hasn't said how many credentials were stolen or what the proprietary information covered.
This breach is mainly about employees, not customers. If you work or worked at NVIDIA, a cracked work password may have been reused elsewhere, and a work email is an easy target for phishing that mentions the company. If you're a customer, there's no sign from NVIDIA's statement that your account was involved.
NVIDIA's own account is short. It linked the incident to neither ransomware nor any wider campaign, and it hasn't published a list of what was taken, so the Have I Been Pwned count is the only firm number on how many people were affected.
What to do if you were in it
- 1
Change your NVIDIA password and any copy of it
If you reuse the NVIDIA password anywhere, change it there too, starting with email and banking. Use a unique password for each account and turn on two-factor authentication where it's offered.
- 2
Turn on two-factor authentication
Use an authenticator app or a security key on your work and personal accounts, so a stolen password alone isn't enough.
- 3
Treat unexpected emails and texts with suspicion
Criminals use breach details to make scam messages sound real. If a message mentions the breach or asks you to log in, click a link or share a code, go to the company's site yourself instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks for your email and phone number in breach databases and the dark web and tells you what to do about each hit. Serus can't pull breach data back, but it alerts you when your details turn up.
Frequently asked
Was I affected by the NVIDIA breach?
It mainly involved employee credentials. Have I Been Pwned lists 71,335 accounts, so search your email there or run a free Serus scan.
What was exposed in the NVIDIA breach?
Employee email addresses and password hashes, according to Have I Been Pwned, plus proprietary company information, according to NVIDIA.
Should I change my password?
Yes, if you have or had an NVIDIA employee login, and on any site where you reused that password.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
