A developer’s personal AWS key with mongodb:Read permission was leaked in a public GitHub repo. Attackers used it to mongodump directly.
Although Nitro used bcrypt to hash passwords—a strong cryptographic standard—the sheer volume of emails leaked allowed hackers to launch credential stuffing attacks. Cybercriminals took the leaked Nitro email addresses and tested them against other enterprise software, banking portals, and email providers, capitalizing on the common habit of password reuse. Regulatory and Financial Consequences
Nitro PDF Data Breach: What Happened and How to Protect Your Data
While encrypted, these are susceptible to cracking if users have weak passwords.
before being leaked for free (or for a nominal $3 access fee) in January 2021. Information Stolen The 14 GB database contained approximately 77,159,696 user records . The exposed data included: Personal Identity: Full names, first names, and last names. Contact Details: Over 70 million unique email addresses and phone numbers. Security Credentials: Bcrypt-hashed passwords. Workplace Info: Company names and professional titles. Document Metadata: nitro pdf data breach
Nitro used for password hashing—a strong, adaptive algorithm. In theory, that made passwords difficult to crack. But “difficult” is not “impossible.”
The stolen database contained approximately 70 million user records . The exposed information included:
This article will explore the details of that breach—from its initial announcement as a minor incident to the eventual leak of 77 million user records. We’ll cover what happened, what data was stolen, who was affected, and what you need to do to protect yourself.
Titles of documents uploaded for signing or conversion, creation dates, and user permissions. Cybercriminals took the leaked Nitro email addresses and
By January 2021, it became clear that the incident was far from minor. A data dump containing over 70 million records appeared on a hacker forum, originally listed for sale for $80,000. Later, an updated list of breached data, totaling over 77 million records, was published online. What Data Was Compromised?
The titles of documents that were uploaded, converted, or signed through Nitro’s services were stolen.
Tools like 1Password or Bitwarden help you maintain unique passwords for every service so that one breach doesn't compromise your entire digital life.
In October 2020, , a popular provider of PDF editing and e-signature tools, confirmed a significant data breach. An unauthorized third party gained access to user accounts and databases. While Nitro acted quickly, the exposed data has since appeared on hacking forums, putting affected users at risk of credential stuffing attacks and phishing. 000. The occurred in September 2020
A massive data breach, exposing nearly —including email addresses, full names, hashed passwords, and in some cases, cryptographic API keys and document metadata—sent shockwaves through the cybersecurity community. What made the Nitro breach different wasn’t just its scale. It was the long tail of exposure: a database left unprotected for months, discovered not by Nitro’s own security team, but by independent researchers scanning the open internet.
A well-known threat actor operating under the alias "ShinyHunters" listed a massive Nitro PDF database for sale on a dark web marketplace. The actor set the starting price for the stolen data at $80,000.
The occurred in September 2020 , compromising the data of over 77 million users and exposing corporate details of major tech giants. The attack, orchestrated by the notorious cybercriminal group ShinyHunters , initially targeted an isolated database used for Nitro’s cloud-based logging services.
Organizations must enforce the use of unique, complex passwords across all platforms to negate the threat of credential stuffing. Utilizing enterprise password managers is the most effective way to achieve this. Enforce Multi-Factor Authentication (MFA)