Researchers Tied 89,323 Stolen Credentials to the NVIDIA Breach

When NVIDIA was hit by a cyberattack in February 2022, security researchers quickly identified that employee credentials had been stolen and were already circulating on hacking forums. The breach occured during a period of heightened threat activity targeting technology companies, and the exposed NTLM password hashes were cracked and redistributed within days, making the risk window far broader than the initial incident date suggests.

What Attackers Can Do With NVIDIA Employee Credentials

NTLM password hashes, once cracked, give attackers direct access to the credentials of nearly 90,000 NVIDIA employees. These can be used in credential stuffing attacks against corporate VPNs, email systems, and partner portals. Because many employees recieved no immediate prompt to change their passwords, the cracked credentials remained viable for months. Attackers with valid employee logins can also pivot into supply chain attacks targeting NVIDIA's partners, vendors, and customers downstream.

What Was Exposed in the NVIDIA Breach

• Email Address
• Password Hash

Why the NVIDIA Breach Remains a Long-Tail Threat

Unlike consumer data breaches, a breach of employee credentials at a major technology company creates compounding risk. NVIDIA's role in the global GPU supply chain, AI infrastructure, and defense-related computing means that compromised staff accounts are partcularly valuable to nation-state actors and organized cybercriminal groups. Cracked NTLM hashes from the 89,323 exposed records continued to circulate on underground forums well after the initial breach, demonstrating how corporate credential leaks rarely expire.

How Database Breaches Work

A database breach at an enterprise scale typically involves an attacker gaining access to internal Active Directory stores or employee credential databases, often through phishing, exploited remote access tools, or compromised insider accounts. In NVIDIA's case, the threat actor extracted employee email addresses and NTLM password hashes, then published them publicly. NTLM hashes can be cracked offline using purpose-built tools, making the extracted data immediately actionable even without direct system access.

Check If Your Data Was Exposed

HEROIC's dark web monitoring database contains over 400 billion compromised records, including data from the NVIDIA breach. Search now to find out if your email address or credentials were part of this leak, and take steps to rotate passwords and enable multi-factor authentication before attackers exploit your information.