NVIDIA Employee Credentials Breached – 71,335 Emails and Password Hashes Exposed
What Happened — In February 2022, NVIDIA’s internal systems were compromised, leaking 71,335 employee email addresses and NTLM password hashes. The hashes were later cracked and circulated among threat actors.
Why It Matters for Trust & Control Assurance —
- Credential exposure directly tests the effectiveness of identity‑and‑access controls and password‑storage policies that continuous‑control programs must monitor.
- Demonstrates the need for real‑time detection of leaked credentials to maintain a defensible audit trail.
- Aligns with the Access Controls capability, enabling organizations to prove they enforce strong hashing, rotation, and monitoring practices.
Who Is Affected — Semiconductor and technology manufacturers; any organization that stores employee credentials.
Recommended Actions —
- Upgrade password hashing to salted, adaptive algorithms (e.g., bcrypt, Argon2).
- Deploy credential‑monitoring services that alert on exposed hashes and enforce forced password resets.
- Capture evidence of password policy enforcement for audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/NVIDIA
Technical Notes — Attack vector appears to be credential theft; exposed data includes email addresses and NTLM password hashes, many of which were cracked. Source: https://haveibeenpwned.com/api/v3/breach/NVIDIA