Over 70,000 NVIDIA Employee Email Addresses and Password Hashes Leaked

hackers have been able to access the email addresses and password hashes of over 70,000 NVIDIA employees. This breach is likely one of many as cybercrime becomes increasingly diversified with malicious intent.

NVIDIA image

Lapsus$, the ransomware gang that managed to capture a terabyte of confidential data from NVIDIA last week, has threatened that until green team satisfies its demands, it would begin publishing some of the company’s “most tightly held secrets” today.

Will NVIDIA finally cave in and do anything as outrageous as eliminating the hash rate cap from its GeForce RTX 30 Series LHR models and/or open-sourcing its graphics chip drivers, as the hackers have demanded? Although we won’t know the answer until tomorrow, Lapsus$ has already proved its seriousness by delivering an appetizer in the shape of thousands of leaked NVIDIA employee credentials.

According to a blurb from Have I Been Pwned’s (HITB) directory of “pwned” websites, NVIDIA workers’ email addresses and password hashes have been exposed, with most of the latter having already been broken by members of the hacking community. Since Tuesday, NVIDIA hasn’t updated their incident response website.

“We want Nvidia to publish an upgrade for all 30 series firmware that removes every LHR constraint,” stated the Lapsus$ Telegram group. “If they take away the LHR, we’ll lose track of [the] folder… We’re both aware of the effect LHR has on mining and gaming.”

Websites that have been hacked (Have I Been Pwned)

NVIDIA, a semiconductor firm, had a data breach in February 2022, exposing employee passwords and intellectual code. Over 70k employee email addresses and NTLM password hashes were exposed, many of which were cracked and disseminated within the hacker community.

Date of the breach: February 23, 2022
2 March 2022 (added to HIBP)
71,335 accounts have been compromised.
Email addresses and passwords were among the information stolen.

Thousands of Nvidia employee credentials have been leaked online as the ransom deadline for hackers approaches (TechCrunch)

While Nvidia has already admitted that employee credentials were stolen in the assault, it has refused to clarify whether individuals impacted have been alerted or whether password changes have been mandated for compromised accounts.
Unless Nvidia accepts the group’s odd requests, the hackers are threatening to reveal Nvidia’s trade secrets, including schematics, source code, and details on current Nvidia graphics processors, including the as-yet-unannounced RTX 3090 Ti.
The organization demanded that Nvidia remove its contentious Lite Hash Rate (LHR) feature, which restricts the ability of its RTX 30 series graphics cards to mine Ethereum.
Lapsus$ added another unexpected demand earlier this week: it wants Nvidia’s graphics chip drivers for macOS, Windows, and Linux devices to be open source. The committee gave Nvidia until today, March 4th, to comply.