# NVIDIA GeForce NOW Armenian Data Breach via GFN.am Alliance Partner Compromise — ShinyHunters-Branded PII Theft

> NVIDIA confirmed a GeForce NOW data breach limited to its Armenian regional Alliance partner GFN.am, with PII (full name, email, phone, DOB, username) exfiltrated between March 20–26, 2026. A threat actor branded as ShinyHunters — believed by reporters to be an impersonator — listed samples and offered the full database for $100,000 in BTC/Monero on a hacker forum. NVIDIA-operated infrastructure was not impacted and no passwords were exposed.

- **Published:** 2026-05-08T19:30:00Z
- **Last reviewed:** 2026-05-08T19:30:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0485
- **ID:** TL-2026-0485
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Actor:** ShinyHunters
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 8 May 2026, NVIDIA Corporation confirmed to BleepingComputer that user data from its GeForce NOW cloud gaming service was exposed in a breach, but clarified that the impact is limited to systems operated by GFN.am, the Armenian regional GeForce NOW Alliance partner. NVIDIA stated: "Our investigation found no impact on NVIDIA-operated services. The issue is limited to systems run by a third-party GeForce NOW Alliance partner based in Armenia." Impacted users are being notified by GFN.am directly.

GFN.am operates as an independent regional licensee under the GeForce NOW Alliance partner program. Per NVIDIA's published help content, GFN.am is also responsible for managing GeForce NOW operations across Azerbaijan, Georgia, Kazakhstan, Moldova, Ukraine, and Uzbekistan, although as of the public disclosure no impact on those countries has been confirmed. Alliance partner environments operate independent authentication systems, local customer databases, regional billing platforms, and locally managed infrastructure — meaning a compromise of a partner can fully expose its regional user base while leaving NVIDIA's primary global infrastructure untouched. This incident is a textbook example of trusted-relationship / supply-chain risk in a federated SaaS / cloud-gaming licensee model.

GFN.am's official statement places the incident window between 20 March 2026 and 26 March 2026, with users who registered after 9 March 2026 explicitly excluded from impact (suggesting a credential or system rotation took effect on or around 9 March 2026, or that the attacker accessed a snapshot generated on that cutoff). The data confirmed stolen by GFN.am consists of: full name (only when the account was created via Google sign-in), email address, phone number (only when registered via a mobile operator), date of birth, and username. The threat actor publicly claimed an additional category beyond GFN.am's confirmation — namely membership status and 2FA/TOTP enrollment status. Critically, GFN.am stated that no account passwords were exposed.

The breach was made public when an account using the ShinyHunters handle posted samples and offered the full database for sale on a top-tier English-language hacker forum, demanding $100,000 paid in Bitcoin or Monero. BleepingComputer subsequently updated its report to note that the actor is believed to be a ShinyHunters impersonator rather than the original collective historically associated with the Snowflake-related multi-tenant extortion campaign and prior breaches of AT&T, Ticketmaster, Santander, and Authy. The forum post was later removed; it is unclear whether the database was sold to a buyer or the listing was withdrawn by the seller or moderators. The branding pattern — ShinyHunters or impersonators using ShinyHunters branding, sale on English-language hacker forums, BTC + Monero payment demand, and direct sample-publication tactic — is consistent with the broader 2025–2026 wave of "ShinyHunters extortion" campaigns chronicled across multiple unrelated victims (most recently the Canvas LMS login-portal extortion campaign disclosed the same week).

Defender Implications: Although no passwords were leaked, the compromised dataset is a high-value enabler for downstream attacks. The combination of email + full name + DOB + phone is a complete profile for (a) targeted phishing and SIM-swap attacks against users known to engage with cloud gaming services and/or hold Google-linked accounts, (b) credential-stuffing pivots against unrelated services using the leaked email as a username pivot, (c) KYC-style identity validation for downstream account-takeover or fraud, and (d) selective targeting of accounts where the actor knows 2FA/TOTP is NOT enabled (as the threat actor explicitly claims this enrichment field). Organizations operating in the seven GFN.am-managed countries — Armenia, Azerbaijan, Georgia, Kazakhstan, Moldova, Ukraine, and Uzbekistan — should treat the dataset as functionally exposed for their workforce and customer base until GFN.am explicitly confirms regional scope. Organizations running their own SaaS/cloud-service alliance, licensee, or franchise programs should treat this incident as a concrete reminder that brand-attached partner environments are part of the organization's effective attack surface even when contractually independent.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1199 Trusted Relationship
- T1078 Valid Accounts
- T1195 Supply Chain Compromise
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1538 Cloud Service Dashboard
- T1087 Account Discovery
- T1550 Use Alternate Authentication Material
- T1213 Data from Information Repositories
- T1530 Data from Cloud Storage
- T1119 Automated Collection
- T1567 Exfiltration Over Web Service
- T1537 Transfer Data to Cloud Account
- T1657 Financial Theft
- T1565 Data Manipulation

## Sources

- [NVIDIA confirms GeForce NOW data breach affecting Armenian users](https://www.bleepingcomputer.com/news/security/nvidia-confirms-geforce-now-data-breach-affecting-armenian-users/)
- [GFN.am Armenian Regional GeForce NOW Operator (homepage)](https://gfn.am/)
- [NVIDIA GeForce NOW Alliance / Regional Partners (help page)](https://www.nvidia.com/en-us/geforce-now/)
- [DailyDarkWeb — original threat-actor forum post screenshot (cited by BleepingComputer)](https://dailydarkweb.net/)
- [Canvas login portals hacked in mass ShinyHunters extortion campaign (contemporaneous ShinyHunters-branded campaign)](https://www.bleepingcomputer.com/news/security/canvas-login-portals-hacked-in-mass-shinyhunters-extortion-campaign/)
- [MITRE ATT&CK — T1199 Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
- [MITRE ATT&CK — T1213 Data from Information Repositories](https://attack.mitre.org/techniques/T1213/)
- [MITRE ATT&CK — T1567 Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567/)
- [MITRE ATT&CK — Group ShinyHunters (G1051)](https://attack.mitre.org/groups/G1051/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0485