Nvidia has confirmed that some users of its GeForce NOW service have had their data compromised. The company said the breach occurred not on Nvidia’s own infrastructure, but on the systems of its regional partner, GFN.am, operating in Armenia.
The first reports of the breach emerged after a post on a hacker forum. A user with the nickname “ShinyHunters” claimed to have gained access to millions of GeForce NOW accounts. Later, it was suggested that the post was made by someone unrelated to the group.
According to the information released by the hackers, the database contained users’ names, email addresses, usernames, dates of birth, subscription status, and two-step verification information. A portion of the database was shared as a sample, while the full database was offered for sale in Bitcoin or Monero for $100,000. The post has since been removed from the forum.
Nvidia said that the services it directly manages were not affected by the incident. The investigation revealed that the attack only affected the systems of its Armenian partner, which operates within the GeForce NOW Alliance program. The company is working with GFN.am to address the incident and inform users.
GFN.am also confirmed the cyberattack and said that the attack lasted from March 20 to 26. According to the operator, the full name, email address, phone number, date of birth and username of users who registered with a Google account may have been leaked. The company emphasized that account passwords were not stolen.
In addition, GFN.am noted that users who registered after March 9 were not affected by the incident. Nvidia's help page indicates that GFN.am operates the GeForce NOW service not only in Armenia, but also in other countries in the region. However, it is not yet known whether the leak affected other countries.
