One of the largest United States chipmakers, Nvidia, was recently involved in an extortion scheme after their data was stolen. The group, named “Lapsus$”, claim they stole one (1) terabyte (TB) of internal data from the company including employee credentials, documentation, private tools, SDKs, as well as information about their proprietary drivers, schematics, and firmware. Lapsus is not a well-known name in English security news as they are most famous for targeting Spanish and Portuguese businesses. While most extortion schemes ask for money, Lapsus’ goal is instead to get Nvidia to remove “LHR” limitations from their graphics card. This feature in their proprietary drivers is a way to prevent cryptocurrency miners from using consumer-grade GPUs to mine, a limitation that Lapsus states “impact[s] mining and gaming.” Following the announcement, Lapsus claimed Nvidia “hacked back” and encrypted the stolen data on the attacker’s machine. The threat actors used Mobile Device Management to connect a virtual machine to Nvidia’s network. Using that connection, Lapsus claims Nvidia connected back to their machine and deployed ransomware which destroyed the data, though it did not affect a backup the group had previously made. The threat actors have begun leaking data related to the GPU driver since their demands have not been met. CTIX analysts are monitoring the situation and will provide updates for any future developments.