NVIDIA Brev Data Breach Investigation

Security researcher Kevin Beaumont publicly shared an excerpt of a notice identifying NVIDIA as the sender. The excerpt says an investigation found unauthorized activity affecting Brev from October 4 through October 20, 2026, and that information associated with the recipient may have been affected. It also describes steps to secure systems and assess the information involved.

An October 31 post by International Cyber Digest reports that NVIDIA is notifying Brev users and that SSH keys provisioned for their virtual machines may have been exposed. Possible exposure of those keys is the reported concern; the post does not establish that an attacker used a particular customer’s key.

Hall Attorneys reviewed the public notice excerpt and report, not a complete customer notice delivered directly by NVIDIA. We have not independently authenticated the notice, confirmed its full contents, or established which customers received it. The sources reviewed do not establish the number of affected users, the entry point, or the extent of any subsequent access.

October 4–20 is the activity window described in the shared notice. It does not establish when each account, key, or virtual machine was affected. Publication of a report on October 31 does not establish when NVIDIA discovered the activity or first notified customers.

We would like to hear from Brev users, subscribers, developers, and authorized representatives of organizations with potentially affected accounts or environments, particularly those who:

• Received a notice identifying NVIDIA Brev or possible exposure of a Brev-provisioned SSH key.
• Used Brev development environments associated with the reported October 4–20 activity window and have related security concerns.
• Encountered unfamiliar logins, account changes, development activity, resource usage, or charges and have information suggesting a connection.
• Spent time or money reviewing logs, replacing credentials, restoring environments, or obtaining security assistance in response to the report or a notice.

Using Brev or another NVIDIA product does not establish that your information was affected. Suspicious activity alone does not establish a connection to this report. You may request a review while the facts are still being investigated.

An initial inquiry does not identify you publicly as a client or plaintiff. Tell us whether you are contacting us personally or as an authorized representative of an organization.