Lapsus$ Breach of Nvidia Led to Data Leaks and Stolen Certificate Abuse

Nvidia said a cyberattack exposed employee credentials and proprietary data after the extortion group Lapsus$ claimed it had breached the company’s corporate network and stolen more than 1TB of information. Reports said the stolen material included schematics, firmware and driver source code, and a leak of usernames and cryptographic password hashes for 71,335 employees. The group also issued an unusual extortion demand, threatening further leaks unless Nvidia removed its Lite Hash Rate (LHR) restrictions from GeForce RTX 30-series graphics cards.

The fallout expanded beyond the initial intrusion as attackers began using stolen Nvidia code-signing certificates to sign malware and malicious Windows drivers, including tools such as Cobalt Strike, Mimikatz, backdoors, RATs, and a Quasar sample. Researchers warned that even expired certificates could still allow signed drivers to load in Windows, complicating defenses and raising the risk of broader downstream abuse. The incident unfolded amid wider concern over high-profile intrusions linked to Lapsus$, including a separate breach that prompted Ubisoft to order a company-wide password reset.