, which are difficult but not impossible to crack. IP addresses and account creation details. Company names and titles of corporate users. 2. Document Metadata and Titles
Nitro used for password hashing—a strong, adaptive algorithm. In theory, that made passwords difficult to crack. But “difficult” is not “impossible.”
was being auctioned alongside user credentials on the dark web. securityaffairs.com Timeline of Events Data Breach - Nitro Sign
. While initially described by the company as a "low impact" incident, the breach eventually exposed the personal information of over 77 million users community.gonitro.com Scope and Impact Total Records Compromised nitro pdf data breach
The Nitro PDF data breach is a stark reminder of the vulnerabilities inherent in third-party software, especially cloud-based services. A breach at a single vendor can expose sensitive data for thousands of other organisations, including the world's largest companies. The incident underscored how companies like Google, Apple, and Microsoft were caught in the crossfire, with their confidential documents and employee details put up for auction on the dark web.
This article will explore the details of that breach—from its initial announcement as a minor incident to the eventual leak of 77 million user records. We’ll cover what happened, what data was stolen, who was affected, and what you need to do to protect yourself.
The breach exposed a database containing roughly 70 million user records. This included full names, email addresses, company names, titles, and bcrypt-hashed passwords. , which are difficult but not impossible to crack
Following the breach, Nitro announced:
Today, Nitro Software still operates—it was acquired by a private equity firm in 2021 and continues to sell PDF tools. But for the 77 million users whose data was left exposed on the open internet, the company’s name will forever be linked to one of the most avoidable breaches in SaaS history.
In late 2020, Nitro Software, the company behind the popular Nitro PDF productivity suite, became the victim of a massive cyberattack. This incident quickly escalated into one of the most significant corporate data breaches of the year. It exposed the sensitive data of millions of users and dozens of Fortune 500 companies. But “difficult” is not “impossible
The stolen database was initially auctioned on the dark web for a starting price of $80,000 before being leaked for free by actors claiming affiliation with ShinyHunters. Timeline of the Incident Sept 28, 2020 The actual date of the breach occurrence. Oct 21, 2020
✅ Credit card details, bank account info, or e-signature document contents. Nitro uses third-party payment processors, so that sensitive data never lived on their compromised servers.
