The ransomware group that claimed to be behind last week’s Nvidia cyber attack has released part of the data it stole from the company.
Nvidia was the victim of a ransomware attack last week, according to a Bloomberg source. The incident wasn’t connected to the Ukraine conflict and, at the time, looked to be relatively minor.
However, the attack may have been more serious than first thought, as Nvidia’s email systems and developer tools reportedly suffered outages as a result, according to the Telegraph.
A source told the publication that the intrusion had completely compromised the company’s internal systems, although some email services did return on Friday. At the time it was unclear whether any data had been stolen or deleted from the company.
Today, the extortion group LAPSU$ announced it has leaked part one of Nvidia data, which apparently contains source code and highly confidential or secret data from various parts of Nvidia’s GPU drivers, according to Telegram posts made by the group and seen by cyber security researcher Soufiane Tahiri.
The group included a download link to the data in its post, although this is yet to be verified.
LAPSU$ took responsibility for the attack on 26 February, saying it breached Nvidia and exfiltrated over 1TB of data. It planned to leak all Nvidia employees passwords and NTLM hashes.
However, LAPSU$ also claimed that Nvidia launched a ransomware attack of its own on the group in retaliation. The group called the company criminals, underlining it was fortunate it had backed up its data.
LAPSU$ said that Nvidia was able to carry out the hack as access to Nvidia’s employee VPN requires the PC to be enrolled in mobile device management. Through this, the company was able to connect to a virtual machine the hacking group uses.
RELATED RESOURCE
The best defence against ransomware
How ransomware is evolving and how to defend against it
“Yes they successfully encrypted the data,” wrote the group in a Telegram post. “However we have a backup and it’s safe from scum!!!”
The group also said it didn’t plan to leak the data, but Nvidia made the “scummy move” to try and delete its personal data.
“We are investigating an incident,” a spokesperson from Nvidia told IT Pro. “Our business and commercial activities continue uninterrupted. We are still working to evaluate the nature and scope of the event and don't have any additional information to share at this time."
-
Why are many men in tech blind to the gender divide?In-depth From bias to better recognition, male allies in tech must challenge the status quo to advance gender equality
-
BenQ PD3226G monitor reviewReviews This 32-inch monitor aims to provide the best of all possible worlds – 4K resolution, 144Hz refresh rate and pro-class color accuracy – and it mostly succeeds
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the lastNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field dayNews February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
-
The Zservers takedown is another big win for law enforcementNews LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
