A stolen database from NitroPDF containing the email addresses, names, and passwords of more than 77 million records of Nitro PDF service users was leaked recently for free. The 14GB leaked database contains 77,159,696 records with users’ email addresses, full names, encrypted passwords, titles, company names, IP addresses, and other system-related information.
Nitro offers a similar service to Adobe PDF, enabling the conversion of PDF documents into editable formats as well as other functions.
Nitro Software originally disclosed a “low impact security incident” on October 21, 2020, stating that no customer data was impacted. But the problem was bigger than they thought as several of the world’s largest technology companies use Nitro’s services to create confidential PDF documents such as non-disclosure agreements and contracts. The firm found that the breached repository, which is supposedly on auction on the deep web, contains over 17,000 documents belonging to Amazon, over 6,000 belonging to Apple, over 32,000 belonging to Google, and 2,390 to Microsoft.
Although the passwords affected were encrypted, if decrypted they could potentially be used to log into accounts and find documents made by or shared with the compromised user. Allowing the attackers to see confidential documents and possibly sell them to the highest bidder.
As always, if you use this service or have in the past, we strongly recommend you change your password and use best practice, use letters, numbers, and symbols, and make sure your password is at least 12 characters and unique. We also strongly recommend that you enable 2FA (2 Factor Authentication) wherever possible.