Massive Nitro data breach impacts Microsoft, Google, Apple, more

A massive data breach suffered by the Nitro PDF service impacts many well-known organizations, including Google, Apple, Microsoft, Chase, and Citibank.

Claimed to be used by over 10 thousand business customers and 1.8 million licensed users, Nitro is an application used to create, edit, and sign PDFs and digital documents.

As part of their service offering, Nitro offers a cloud service used by customers to share documents with coworkers or other organizations involved in the document creation process.

Nitro software suffers a data breach

On October 21st, Nitro Software issued an advisory to the Australia Stock Exchange, stating that they were affected by a "low impact security incident" but that no customer data was impacted.

It turns out that there may be more to the story than initially stated.

Cybersecurity intelligence firm Cyble has told BleepingComputer that a threat actor is selling the user and document databases, as well as 1TB of documents, that they claim to have stolen from Nitro Software's cloud service.

This data is now being sold in a private auction with the starting price set at $80,000.

Cyble states that the 'user_credential' database table contains 70 million user records containing email addresses, full names, bcrypt hashed passwords, titles, company names, IP addresses, and other system-related data.

BleepingComputer was able to determine the stolen user database's authenticity by confirming known email addresses of Nitro accounts that were present in the database.

The document database contains a file's title, whether it was created, signed, what account owns the document, and whether it's public.

According to Cyble, these databases contains a considerable amount of records related to well-known companies, as illustrated in the table below:

Company	# of accounts	# of documents
Amazon	5,442	17,137
Apple	584	6,405
Citi	653	137,285
Chase	85	177
Google	3,678	32,153
Microsoft	3,330	2,390

From the samples of the database shared with BleepingComputer, the document titles alone disclose a great deal of information about financial reports, M&A activities, NDAs, or product releases.

If the threat actors stole the documents as they claim, this could be one of the worst corporate data breaches we have seen in a while.

As Nitro is commonly used by businesses to sign sensitive financial, legal, and marketing documents digitally, it could allow for the leaking of information that would significantly impact a company's business.

BleepingComputer has not been able to confirm if documents were stolen in this attack.

For those who are concerned that their Nitro account is part of this breach, Cyble has added the data to their AmIBreached.com service. Users can submit their email address and check if it was disclosed in the stolen database using this service.

Update 10/27/20: Nitro has sent BleepingComputer an updated statement that "the email domains in these logs do not constitute Nitro 'customers' or 'accounts.'  Unfortunately, this does not appear accurate as the user database seen by BleepingComputer does contained a bcrypt hashed password column.