NVIDIA GeForce NOW Data Breach Affects Armenian Users
Tech giant NVIDIA has confirmed a data breach within its popular cloud gaming service, GeForce NOW. The breach specifically targeted users in Armenia, exposing personal information.
Event Summary
On May 8, 2026, technology and graphics processing giant NVIDIA officially confirmed that its cloud-based gaming service, GeForce NOW, had suffered a data breach. The incident, first brought to light by the cybersecurity news outlet BleepingComputer, was verified by NVIDIA's subsequent statement. According to the company, the cyberattack was geographically targeted, primarily affecting the data of GeForce NOW users residing in Armenia. This detail suggests the breach was likely a planned action aimed at a specific user group rather than a random event. NVIDIA announced that it had activated its security protocols and launched a comprehensive investigation immediately upon discovering the incident.
Leaked Data and Scope
In its initial statement, NVIDIA did not specify the exact types of information compromised, using the general term "user information." In cybersecurity incidents, this term typically encompasses sensitive data such as:
- Usernames and Email Addresses: The primary credentials users employ to log into the platform. This information is frequently used for phishing attacks.
- Hashed Passwords: These are not the actual passwords but their cryptographically scrambled versions. If a weak hashing algorithm was used or if users chose weak passwords, these hashes could be cracked to reveal the original passwords.
- Geographic Location Data: The fact that the breach was focused on Armenia indicates that at least country-level location data was exposed.
- Account Settings and Usage Data: User preferences on the platform, games played, and session durations could also be at risk.
Although the company stated that no credit card information or other financial data was affected by this breach, the exposed email and password combinations can be used for a type of attack known as "credential stuffing." In this method, cybercriminals take the stolen login credentials from one platform and attempt to use them on other popular websites (social media, e-commerce, banking) to compromise users' other accounts. Therefore, not only are the GeForce NOW accounts of affected users at risk, but so are all other accounts where they may have reused the same password. Using a Data Breach Search tool to check if your email has appeared in other known breaches can be a proactive step for your overall digital security.
Has your email been leaked? Check for free — results in seconds.
Check Now →Technical Aspects of the Attack
NVIDIA has not yet shared technical details about how the attack was carried out. Such information is typically disclosed after a forensic investigation is complete. However, a cyberattack of this scale could have occurred through several possible scenarios:
- API Vulnerability: Modern cloud services use Application Programming Interfaces (APIs) to allow different components to communicate. A security flaw in one of these APIs could have allowed attackers to gain unauthorized access to the database.
- Misconfigured Cloud Storage: Companies sometimes inadvertently configure their cloud storage buckets (like Amazon S3 or Microsoft Azure Blob Storage) to be publicly accessible. Such a configuration error leaves sensitive data unprotected.
- Third-Party Integration Issue: GeForce NOW may use regional partners or third-party software to deliver its services. If the attack originated through one of these partners' systems, the source of the breach could be a vulnerability outside of NVIDIA's direct control.
- Phishing and Social Engineering: The theft of an authorized NVIDIA employee's credentials could have granted attackers internal access to the systems. This is often accomplished through targeted phishing attacks.
The specific targeting of Armenian users suggests that the attackers either targeted a server cluster in that region or found a vulnerability in the systems of a local partner in Armenia.
Who Are the Affected Users
NVIDIA's statement clearly indicates that the scope of the data breach is primarily limited to GeForce NOW users in Armenia. While this means that the majority of the millions of GeForce NOW users worldwide are not directly affected, some nuances could complicate the situation. For instance, users living outside of Armenia who registered their accounts through that country or use servers in that region might also be at risk. The company has stated it will notify all affected users directly via email and provide guidance on the necessary steps to take. Therefore, it is crucial for all GeForce NOW users, especially those with ties to Armenia, to monitor their email inboxes for official notifications from NVIDIA.
What Should You Do
If you are a GeForce NOW user and believe you may have been affected by this breach, you can minimize the risks by taking the following steps:
- Change Your Password Immediately: The first and most important step is to change your NVIDIA account password right away. Ensure your new password is strong, long, and unique—not used on any other platform.
- Enable Two-Factor Authentication (2FA): If you haven't already, enable 2FA on your NVIDIA account. This adds an extra layer of security that prevents unauthorized access even if your password is stolen.
- Be Wary of Suspicious Emails: Cybercriminals may use this breach to send phishing emails impersonating NVIDIA. Do not trust any email that asks for your personal information or password. Follow NVIDIA's official communication channels.
- Check Your Other Accounts: If you used the same password for GeForce NOW on other websites or services, change those passwords immediately as well. This will protect you against credential stuffing attacks.
The Company's Statement
NVIDIA demonstrated a transparent stance by confirming the incident in its official statement to BleepingComputer. A company spokesperson stated, "We recently became aware of an incident involving a partner in Armenia for GeForce NOW, which resulted in the exposure of limited user information, such as usernames and hashed passwords, for a small number of Armenian users. Upon discovery, we immediately launched an investigation, informed the partner, and urged affected users to reset their passwords. We want to emphasize that no financial information was impacted. We take the security of our customers very seriously and apologize for this situation." This statement suggests that the source of the breach may be a local partner rather than NVIDIA's own core systems. The results of the company's ongoing investigation will shed more light on the full cause and scope of the incident.