Hacking group leaks Nvidia data following alleged ransomware attack
LAPSU$ claims to have released Nvidia source code and highly confidential GPU driver data
The ransomware group that claimed to be behind last week’s Nvidia cyber attack has released part of the data it stole from the company.
Nvidia was the victim of a ransomware attack last week, according to a Bloomberg source. The incident wasn’t connected to the Ukraine conflict and, at the time, looked to be relatively minor.
However, the attack may have been more serious than first thought, as Nvidia’s email systems and developer tools reportedly suffered outages as a result, according to the Telegraph.
A source told the publication that the intrusion had completely compromised the company’s internal systems, although some email services did return on Friday. At the time it was unclear whether any data had been stolen or deleted from the company.
Today, the extortion group LAPSU$ announced it has leaked part one of Nvidia data, which apparently contains source code and highly confidential or secret data from various parts of Nvidia’s GPU drivers, according to Telegram posts made by the group and seen by cyber security researcher Soufiane Tahiri.
The group included a download link to the data in its post, although this is yet to be verified.
LAPSU$ took responsibility for the attack on 26 February, saying it breached Nvidia and exfiltrated over 1TB of data. It planned to leak all Nvidia employees passwords and NTLM hashes.
However, LAPSU$ also claimed that Nvidia launched a ransomware attack of its own on the group in retaliation. The group called the company criminals, underlining it was fortunate it had backed up its data.
LAPSU$ said that Nvidia was able to carry out the hack as access to Nvidia’s employee VPN requires the PC to be enrolled in mobile device management. Through this, the company was able to connect to a virtual machine the hacking group uses.
RELATED RESOURCE
The best defence against ransomware
How ransomware is evolving and how to defend against it
“Yes they successfully encrypted the data,” wrote the group in a Telegram post. “However we have a backup and it’s safe from scum!!!”
The group also said it didn’t plan to leak the data, but Nvidia made the “scummy move” to try and delete its personal data.
“We are investigating an incident,” a spokesperson from Nvidia told IT Pro. “Our business and commercial activities continue uninterrupted. We are still working to evaluate the nature and scope of the event and don't have any additional information to share at this time."
-
Low-budget devices are the biggest casualty of the RAM crisisNews Say goodbye to budget devices; vendors are doubling down on high-end options to absorb costs
-
Sectigo taps Clint Maddox to lead global field operationsReviews The appointment follows a year of strong momentum for the security vendor as it expands its global channel footprint
-
The rise of teen hackers ‘makes for a good headline’, but cyber crime activities peak later in lifeNews With family responsibilities and mortgages to pay, it's not teenagers dishing out malware or carrying out cyber extortion
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Ransomware gangs are sharing virtual machines to wage cyber attacks on the cheap – but it could be their undoingNews Thousands of attacker servers all had the same autogenerated Windows hostnames, according to Sophos
-
Google issues warning over ShinyHunters-branded vishing campaignsNews Related groups are stealing data through voice phishing and fake credential harvesting websites
-
The FBI has seized the RAMP hacking forum, but will the takedown stick? History tells us otherwiseNews Billing itself as the “only place ransomware allowed", RAMP catered mainly for Russian-speaking cyber criminals
-
Everything we know so far about the Nike data breachNews Hackers behind the WorldLeaks ransomware group claim to have accessed sensitive corporate data
-
There’s a dangerous new ransomware variant on the block – and cyber experts warn it’s flying under the radarNews The new DeadLock ransomware family is taking off in the wild, researchers warn
-
Hacker offering US engineering firm data online after alleged breachNews Data relating to Tampa Electric Company, Duke Energy Florida, and American Electric Power was allegedly stolen
