Lapsus$ Nvidia Breach: One Set of Stolen Credentials Exposed Source Code

Lapsus$ obtained valid employee credentials for Nvidia and used them to reach internal source-code repositories and employee records. The stolen credentials granted direct access without any further proof of identity, allowing the group to copy proprietary material and data before detection.

According to Verizon's 2023 DBIR, stolen credentials remained the top initial-access vector for the fifth consecutive year. In the Nvidia case the attackers simply logged in with the captured details, and the session they received worked across every system the account could reach.

How a Single Set of Stolen Credentials Opened Nvidia's Repositories

The attackers used the credentials against Nvidia's corporate environment in early 2022. Public reports show no proxy server or real-time interception was required; the login itself succeeded because the password and any associated factors traveled together. Once inside, the same session token let them browse code repositories and pull employee information without triggering new authentication checks.

Nvidia confirmed the loss of source code and internal records. A reusable credential had no hardware boundary, so any machine holding the correct values could repeat the login. Federation protocols then expanded the reach: one successful sign-in issued tokens that downstream services accepted without demanding fresh proof from the original device.

The same credential-reuse pattern appeared in other Lapsus$ operations that year. After the first login cleared, no second authentication step stood between the attackers and additional targets.

Why Reusable Login Details Created the Entire Breach

Any second factor tied to the same account would have been satisfied the moment the stolen credentials were entered. The factor moves with the login rather than being locked to specific hardware, so whoever possesses the password can complete it. Device-bound keys eliminate that path because the private key stays inside the enrolled machine and every signature must be produced on that device for the exact service being accessed.

After the initial login, the attackers operated with live sessions and tokens that required no further sign-in. The damage therefore flowed from the absence of a hardware-bound check at entry, not from any later bypass of an existing control.

The same credential exposure later hit other organizations that relied on the same reusable factors. Removing the reusable element at the first login stops the chain before any session token is ever issued.

The architecture that enforces a fresh hardware signature on every request is described at mfa2point0.com.

FAQ

How did Lapsus$ gain access to Nvidia systems?
Lapsus$ used stolen employee credentials to log directly into Nvidia's environment. Once the login succeeded, the resulting session granted access to source-code repositories and employee records without additional authentication prompts.

Would a time-based one-time password have stopped the Nvidia breach?
No. The attackers held the credentials themselves, so any factor that travels with the login would have been supplied at the same time. Only a credential bound to enrolled hardware would have required a signature that could not be replayed from another machine.

What role did SSO play in the Nvidia incident?
SSO expanded the blast radius. A single valid login issued federation tokens that multiple internal services accepted without repeating authentication, exactly as documented in other Lapsus$ operations against federated environments.

Did Nvidia require multi-factor authentication on the compromised accounts?
Public disclosures do not state whether the affected accounts carried a second factor. The breach succeeded because the credentials alone were sufficient to obtain working sessions; any factor satisfied by the same login would not have changed the outcome.

What changed for later Lapsus$ campaigns after the Nvidia incident?
The group continued to target reusable credentials across other victims. Organizations that moved to device-bound credentials removed the initial-access vector that Lapsus$ had exploited at Nvidia.