Nvidia Says GeForce Now Breach Was Limited to Armenian Partner, Not Global Accounts

Nvidia has responded after hacking group ShinyHunters claimed it had broken into GeForce Now systems and obtained user records. The short version: Nvidia says its own services were not affected, and the issue appears to involve a third-party GeForce Now Alliance partner in Armenia.

For Malaysian and SEA gamers, this does not look like a panic-level situation. If you are using GeForce Now through your local or regional provider, there is currently no sign from Nvidia that your account is part of this breach. But if you have an account with Armenia’s GFN.am service, or previously used it while travelling or testing different cloud gaming regions, you should pay attention.

What happened?

ShinyHunters reportedly posted on a black hat hacking forum claiming it had accessed a GeForce Now backend database and was looking to sell what it described as millions of user records.

According to the reported claim, the group said the database included details such as names, email addresses, dates of birth, membership information, two-factor authentication status, and more. That 2FA detail matters because attackers can use it to prioritise weaker accounts when attempting login attacks or phishing campaigns.

Nvidia, however, has pushed back on the scale of the claim. In a statement given to VideoCardz, the company said its investigation found no impact on Nvidia-operated services. Instead, Nvidia said the incident was limited to systems operated by a GeForce Now Alliance partner based in Armenia.

That partner is GFN.am, the Armenian GeForce Now provider.

Were passwords stolen?

Based on Nvidia’s direction to GFN.am’s statement, passwords were not accessed.

GFN.am says the exposed information may include a user’s telephone number if the account was registered via mobile operator, and name plus surname if the account was used through Google login.

The provider also said it took action after discovering the incident, including fixing the cause of unauthorised access and adding extra organisational and technical security measures to reduce the chance of something similar happening again.

So yes, this is still bad — any personal data leak can become spam or phishing fuel — but it does not appear to be a full Nvidia global account disaster.

Why Malaysia and SEA players should care

Cloud gaming is still growing in Southeast Asia, especially for players who do not want to spend RM4,000 to RM8,000 on a gaming laptop or desktop. GeForce Now is appealing because it lets you stream higher-end PC games on weaker hardware, assuming your internet connection and server route are decent.

But this incident highlights one annoying reality: cloud gaming is not just about Nvidia’s own security. Regional partners, login systems, billing flows, and local operators all become part of the trust chain. If one partner has weak security, users under that provider can still get hit.

For Malaysian gamers, the practical takeaway is simple:

• Turn on 2FA wherever possible.
• Do not reuse your gaming passwords across email, Steam, Epic, Riot, or cloud gaming accounts.
• Be suspicious of emails claiming to be from Nvidia, GeForce Now, or a regional provider.
• If you ever used GFN.am, change your password and watch for official notifications.

Even if passwords were not taken, leaked names, phone numbers, or email addresses can still be used to make scam messages look more convincing. That is where people usually kena — not from some Hollywood-style hack, but from a “please verify your account” email that looks just real enough.

ShinyHunters has been active lately

The name ShinyHunters may ring a bell because the same group was recently linked to stolen Rockstar data connected to GTA 6. Rockstar reportedly refused to pay a ransom, after which the data was released.

For Nvidia and its GeForce Now partners, the next step is obvious: tighten partner security, communicate clearly with affected users, and make sure cloud gaming customers know exactly what happened.

For the rest of us, this is another reminder that 2FA is not optional anymore. If your gaming account has payment details, rare skins, years of progress, or even just your main email attached, lock it down properly.

Source: PC Gamer