Back

nvidia.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The telemetry indicates a significant exposure event impacting NVIDIA, with over 4.4 million total events recorded between July 2025 and June 2026. A substantial portion of these events, over 3.7 million, are classified as historical data breaches, while over 727,000 are active infostealer logs. The data suggests a widespread compromise affecting approximately 60,000 employees and over 4.3 million clients. The primary malware families observed are Redline, Rhadamanthys, and LummaC2, all known for credential theft. The targeted services are predominantly related to NVIDIA's login and account creation infrastructure, indicating a focus on account takeover and credential harvesting.

Total Events

4,452,375
credential exposure events

Employee Affected Events

60,000
account email domain = nvidia.com

Client Affected Events

4,392,375
service target = nvidia.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
1,500,0001,000,000500,0000
peak month 1,212,396
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events727,013
Share16%
Data breaches
Events3,725,362
Share84%
Infostealer logs (16%)
727,013events
Data breaches (84%)
3,725,362events

60,000 compromised employee accounts pose an infrastructure risk, while 4,392,375 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender6,513
Windows Defender.270
Malwarebytes164
Avast139
Windows Defender McAfee78
McAfee VirusScan68
Avast Norton53
Windows Defender [ON]53
Reason Cybersecurity44

Malware Families Distribution

Distribution of Active Stealer Strains

Redline126,633
Rhadamanthys121,243
LummaC2115,336
Vidar50,028
Acreed46,225
StealC9,724
RisePro9,541
Millenium5,197
Remus5,143

Top Login URLs

Top exposed services found in the event results

  1. 1https://login.nvgs.nvidia.com/v1/create-account586,016
  2. 2https://login.nvgs.nvidia.com493,344
  3. 3login.nvgs.nvidia.com485,459
  4. 4login.nvgs.nvidia.com/v1/create-account369,150
  5. 5https://login.nvgs.nvidia.com/v1/login261,897
  6. 6login.nvgs.nvidia.com/v1/login210,723
  7. 7https://login.nvgs.nvidia.com/v1/login/password153,114
  8. 8https://login.nvgs.nvidia.com/v1/login/identifier127,240
  9. 9https://login.nvgs.nvidia.com/122,718
  10. 10https://login.nvgs.nvidia.com/v1/link-account114,176

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events67,796
Brazil
Events31,731
India
Events25,282
France
Events21,834
Mexico
Events14,943
Türkiye
Events14,239
Spain
Events13,625
United Kingdom
Events13,332

Country Breakdown

  1. 1United States67,796
  2. 2Brazil31,731
  3. 3India25,282
  4. 4France21,834
  5. 5Mexico14,943
  6. 6Türkiye14,239
  7. 7Spain13,625
  8. 8United Kingdom13,332

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Microsoft1,525
Citrix49
Cisco (AnyConnect)33
Pulse Secure23
FortiNet VPN16
Git14
Amazon Cognito11

Operating System Distribution

Distribution of compromised endpoint builds

Windows 10 Enterprise x6452,543
Windows 11 24H2 build 26100 (64 Bit)51,448
Windows 1149,990
Windows 10 22H2 build 19045 (64 Bit)39,663
Windows 10 Home x6429,044

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
3,702,760
Combolist pools
22,602
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.