Hacking group leaks Nvidia data following alleged ransomware attack

The ransomware group that claimed to be behind last week’s Nvidia cyber attack has released part of the data it stole from the company.

Nvidia was the victim of a ransomware attack last week, according to a Bloomberg source. The incident wasn’t connected to the Ukraine conflict and, at the time, looked to be relatively minor.

However, the attack may have been more serious than first thought, as Nvidia’s email systems and developer tools reportedly suffered outages as a result, according to the Telegraph.

A source told the publication that the intrusion had completely compromised the company’s internal systems, although some email services did return on Friday. At the time it was unclear whether any data had been stolen or deleted from the company.

Today, the extortion group LAPSU$ announced it has leaked part one of Nvidia data, which apparently contains source code and highly confidential or secret data from various parts of Nvidia’s GPU drivers, according to Telegram posts made by the group and seen by cyber security researcher Soufiane Tahiri.

The group included a download link to the data in its post, although this is yet to be verified.

LAPSU$ took responsibility for the attack on 26 February, saying it breached Nvidia and exfiltrated over 1TB of data. It planned to leak all Nvidia employees passwords and NTLM hashes.

However, LAPSU$ also claimed that Nvidia launched a ransomware attack of its own on the group in retaliation. The group called the company criminals, underlining it was fortunate it had backed up its data.

LAPSU$ said that Nvidia was able to carry out the hack as access to Nvidia’s employee VPN requires the PC to be enrolled in mobile device management. Through this, the company was able to connect to a virtual machine the hacking group uses.

“Yes they successfully encrypted the data,” wrote the group in a Telegram post. “However we have a backup and it’s safe from scum!!!”

The group also said it didn’t plan to leak the data, but Nvidia made the “scummy move” to try and delete its personal data.

“We are investigating an incident,” a spokesperson from Nvidia told IT Pro. “Our business and commercial activities continue uninterrupted. We are still working to evaluate the nature and scope of the event and don't have any additional information to share at this time."