NVIDIA cyberattack affects employee, company information

American chipmaker NVIDIA says a cyberattack has affected employee credentials and company proprietary information.

With revenue of $10.92 billion, NVIDIA designs graphics processing units for the gaming and professional markets, as well as a system on chip units for the mobile computing and automotive market.

While the company says there is no evidence of ransomware being deployed on its systems, South-American ransomware group Lapsus$ has allegedly claimed responsibility for the data leak and appears to have data on the schematics, drivers and firmware about the graphics chips. In addition, the threat group posted a link to the first part of the company's data, including 20GB of source code and other highly confidential data.

Source code represents some of the most coveted crown jewels that a company like NVidia possesses, says Prakash Linga, Co-Founder and CEO at BluBracket. As attackers have shifted their focus to exploiting weaknesses in code, it is imperative to detect and prevent code risks in Git repositories that contain the source code, Linga explains. "This frequently overlooked area that makes up the internal software supply chain is where the shift-left movement delivers the most value," says Linga.

While Lapsus$ is relatively new, the threat group has already targeted several influential organizations, including Impresa, a large media conglomerate in Portugal, Brazil's Ministry of Health and Brazilian telecommunications operator Claro.

Maria Henriquez is a former Associate Editor of Security. She covered topics including cybersecurity and physical security, risk management and more.

ON DEMAND: Business-impacting events such as severe weather, man-made disasters, and supply chain disruption are increasing in frequency and making impacts around the globe.

In today's rapidly evolving security landscape, organizations face an ever-growing array of disruptive events, security threats and risks. Traditional reactive approaches to security intelligence often leave businesses vulnerable and ill-prepared to anticipate and mitigate emerging threats that could impact the safety of their people, facilities or operations.