NVIDIA says unauthorized activity on its Brev cloud development platform may have exposed information stored there, including SSH keys associated with customer machines. Tom’s Hardware reports that a customer notice placed the activity between October 4 and October 20. The notice does not state the year for those dates.
An SSH key is a digital credential used to connect to a computer or server. The keys at issue were configured by Brev and used to access customer virtual machines, or VMs: software-based computers running in the cloud. If a key is exposed, it can create a risk of unauthorized access, though NVIDIA says it found no evidence that the keys were misused.
What did NVIDIA do?
NVIDIA says it rotated the affected keys, meaning it replaced them with new ones, and updated customer instances with the replacement keys. That change is intended to prevent the old credentials from being used to connect to those machines. The company’s notice said customer information from its Brev network “may have been affected.”
The company has not said in the details reported by Tom’s Hardware how the unauthorized activity began, which accounts were involved, or whether anyone copied or viewed specific customer data. It also has not reported how many customers received notices. Those gaps make it difficult to tell how broad the incident was from the available information.
What remains unclear
NVIDIA’s statement that it found no evidence of improper use is not the same as saying the keys definitely were not used; it describes what the company says its investigation found. The reported notice does not explain what activity investigators observed or how they checked for misuse.
For Brev customers, the confirmed response is that NVIDIA replaced the potentially affected keys and updated instances. The reported notice does not include further customer steps or say whether customers need to change other credentials. It also does not describe any service disruption or confirmed access to customer VMs.
Why it matters
Brev customers may want to know whether their cloud machines or data were exposed, but NVIDIA’s reported notice does not identify affected accounts or confirm access to customer VMs. The company says it replaced the keys and found no evidence of misuse; whether customers need to take any other steps is not stated.
