How Do You Get to the CEO of Nvidia? The Same Way They Get to You

Sunday night, the board of the most valuable company in the AI boom put out a statement nobody expected. Nvidia — the company whose chips train nearly every serious AI model on the planet — said its founder and CEO, Jensen Huang, had been the target of a foreign intelligence effort, and that it was opening an independent investigation.

The headlines went straight for the affair. That is the wrong part to stare at.

Forget the gossip for a minute and look at the method instead. The most defended executive in tech, running a company with a security budget larger than most countries' intelligence services, was not approached through a firewall or a zero-day. He was approached through a person — a business contact, over time, outside the official channel. And that is exactly how the attempts landing in your inbox work too. The only difference is the budget.

Sunday night, the board said it out loud

Here is what is confirmed, and what is still only alleged — the distinction matters, because the scam emails this story is about to spawn will blur it on purpose.

On November 8, Nvidia's board of directors issued a statement saying it was initiating an independent investigation "in light of recent reporting that founder and CEO Jensen Huang has been the target of a foreign intelligence effort." A committee of independent directors, assisted by outside independent counsel, will run it. Huang remains CEO. The board said it has "no reason to believe that national security or NVIDIA secrets were compromised."

The reporting behind the statement started on October 29, when The New York Times reported that US authorities were investigating Alice Huang, a former executive of Megaspeed, a Singapore-based company that buys AI chips from Nvidia. On November 6, the Times and the Financial Times reported that US intelligence officials assessed she had been recruited by China's Ministry of State Security to establish a relationship with Huang. Beijing has called the claims "groundless speculation." Nvidia has said Huang's interactions with her were ordinary customer contacts and that no sensitive information was shared.

In a message to Nvidia employees, Huang admitted he had been unfaithful to his wife and said he took "full responsibility" for his actions. That much is his own words. The espionage claims are allegations and intelligence assessments, not court findings — and no public statement from Alice Huang or Megaspeed has been reported.

Washington moved fast. Republican leaders of several House committees asked Huang to brief them on his relationship with Alice Huang and Nvidia's safeguards, and Senator Chris Coons called for an investigation. The board's statement landed on a Sunday night, hours before a new trading week — which tells you how seriously the company is taking it.

The $4.8 billion reason anyone would bother

Romance is the headline. Access is the motive.

The New York Times reported that Megaspeed bought $4.8 billion worth of Nvidia chips over the previous two years. That is not a customer. That is a pipeline. And the pipeline is currently stuck: Reuters reported roughly 600,000 of Nvidia's H200 AI chips sitting stockpiled in Hong Kong, awaiting Beijing's approval for shipment into mainland China under US export controls. The chips are the most sought-after hardware in the world right now, and the paperwork deciding who gets them runs through the company Huang leads.

Put that together and the story stops looking like a tabloid item. Nvidia is the tollbooth of the AI economy. Its CEO is the person who can open the gate, speed up a shipment, or explain to a regulator why a customer should be trusted. If you wanted information about where the chips go, who gets priority, or how export controls are enforced, there is exactly one person worth getting close to — and the alleged effort spent months doing it through the most ordinary channel available: a business relationship.

That is the part worth remembering. The approach did not need a vulnerability in Nvidia's software. It needed a credible person with a credible reason to talk to the CEO. Everything else — the trust, the time, the private channel — followed from that.

Forget the affair. Look at the method.

Strip the names out and the shape of this story is one every security team knows by heart. A high-value target. A plausible pretext. A personal channel that bypasses the official process. Time — weeks or months — spent building trust before anyone asks for anything. No malware, no breach, no alarm going off, because nothing technically wrong happened until it was already too late to catch.

This is what "spear-phishing" actually means at the top of the scale. The cheap version, the one you and I get, is an email pretending to be a vendor, a boss, or a bank. The expensive version is a person. But the structure is identical: borrow credibility from something real, move the conversation somewhere private, and ask for the one thing that bypasses every control in place.

It is worth saying plainly because the usual reaction to a story like this is "that could never happen to me." It already does, every day, at your scale. Nobody is spending months cultivating a relationship with you. They don't have to. They can buy your email address, your purchase history, and your employer's name for pennies, and send ten thousand personalized approaches before lunch. The method scales down perfectly.

Your inbox gets the same playbook, just cheaper

Microsoft counted 7.3 billion phishing emails in a single quarter this year — a number so large it stops meaning anything until you remember that each one is a cheap copy of the Nvidia approach: a plausible sender, a plausible reason, a private ask. I wrote about that count in detail when Microsoft's report came out, and the most unsettling part of it was not the volume. It was that almost none of those emails tried to install anything. They just asked. A password reset here, a wire transfer there, a "verify your account" link somewhere else. The ask is the attack.

Big news makes it worse, because big news hands scammers a pretext for free. We have watched this happen three times in the last three days alone. Bitcoin fell below $76,000 and the "withdraw now" emails started the same day, riding the panic. Binance lost $6.3 billion and fake "SAFU reconciliation" emails followed, asking holders to "verify" wallets that were never at risk from the breach itself. Japan's disaster alert system was hacked and 1.42 million phishing emails went out from an address people had been trained to trust.

The Nvidia story will do the same. Within days, expect "Nvidia investor alert" emails, fake board statements, "Huang briefing" updates, and urgent messages about your "NVDA holdings" — most of them arriving in inboxes that have never owned a single Nvidia share. The senders do not care who you are. They care that the story is in the news and you have heard of it. That is enough.

Five tells that a message is a targeted approach, not a coincidence

Most phishing advice tells you to look for bad grammar and misspellings. That advice is a decade out of date — the cheap stuff is now written by the same AI tools as the legitimate stuff. What still gives a targeted approach away is the shape of the ask, not the spelling.

1. It knows something small and true about you. Your employer, a recent purchase, a real event in the news. That detail is the hook, not proof of legitimacy. Public information is free; anyone can use it.

2. It moves you off the official channel. "Reply to this personal address." "Call me directly on this number." "Use this link, not the app." Every legitimate process has a front door. A targeted approach always prefers the side door.

3. It borrows urgency from real news. A crash, a breach, a board investigation, a deadline. Real events create real anxiety, and anxiety is what makes people click before they think. If the message would make no sense without today's headline, be suspicious of it precisely because of today's headline.

4. The sender is close but wrong. A lookalike domain with one letter changed. A free-mail address handling a corporate matter. A display name that says "Nvidia Investor Relations" over an address that has nothing to do with Nvidia. Always read the actual address, never the display name.

5. It asks for the one thing that bypasses every control. A code. A password reset. A wire. A document. Not information — action. The moment a message wants you to do something irreversible, stop and verify through a channel you opened yourself.

None of these tells is proof on its own. Two of them together is a pattern. Three is a verdict.

Where a disposable address actually helps — and where it doesn't

I will be straight about this, because the honest answer is less flattering than the marketing one: a temporary email address will not stop a targeted attack against you. Nothing you do with your inbox will. If someone with real resources decides you specifically are the target, your email setup is not the layer that saves you — your habits are.

What a disposable address does do is shrink the surface. Every signup that takes your real address hands a copy of it to another database, and databases get breached, resold, and harvested. A throwaway address per signup means a breach of one service does not hand attackers your master key, and the flood of "we noticed a login" and "verify your account" messages lands somewhere you can abandon instead of in the inbox you actually read. That matters most exactly when a story like Nvidia's is in the news, because the scam wave that follows a big story is sent to lists built from years of breaches.

What it does not do is just as important. Do not use a temporary address for anything that holds money or identity — your bank, your broker, your password recovery. Those accounts deserve your real address, a unique password, and an authenticator app. And a temporary inbox generally cannot send replies, so it is useless for any conversation you need to continue. I tested that limit directly: a temp inbox is a receiving tool, not a mailbox. Different services treat disposable addresses differently, too — GitHub blocks them at the front door, while others let them straight in — so a throwaway address is a habit, not a guarantee.

The rule I use is simple. If losing access to the account would cost me money, reputation, or identity, it gets my real address and my best security. Everything else — the waitlist, the investor alert signup, the "download the report" form, the free trial — gets an address I can throw away. The Nvidia story is a good reminder of why that line exists: the people who got close to Huang did it through a channel nobody was watching, and your signup address is a channel nobody is watching either.

The ten-minute check I do after any big news story

Stories like this one move fast, and the scam wave moves faster. Whenever a big security or market story breaks, I run the same ten-minute routine on my own inbox. It is boring. That is the point.

First, search the sender's exact domain. Not the company name — the domain after the @. If the only results are the email itself, that is your answer.

Second, open the real site yourself. Never click through from the message. Type the address or use a bookmark. If the message claims something real, the real site will say it too.

Third, check whether the "news" exists on a wire service. A board investigation, a breach, a settlement — Reuters, AP, or Bloomberg will have it within the hour. If only the email knows about it, the email invented it.

Fourth, kill the signup addresses you no longer use. The waitlists and trials from six months ago are still receiving mail, and every live address is a target. Delete what you do not need.

Fifth, move anything financial to a dedicated address. One address, used only for money, never for signups. It will receive almost no mail — which is exactly why any mail it does receive deserves your full attention.

Frequently asked questions

Was Nvidia hacked? No. The board said it has no reason to believe national security or Nvidia secrets were compromised. The investigation is about the CEO being targeted by a foreign intelligence effort, not about a breach of Nvidia's systems.

Did Jensen Huang do anything wrong? He admitted in a message to employees that he was unfaithful to his wife and said he took full responsibility. The espionage claims — that Alice Huang was recruited to gather information connected to him and Nvidia — are allegations and intelligence assessments reported by The New York Times and the Financial Times, not findings. They are under investigation.

Why would anyone target Nvidia's CEO? Megaspeed, the Singapore company at the center of the reports, bought $4.8 billion in Nvidia chips over two years, according to the Times. With US export controls deciding who can buy advanced AI chips, and roughly 600,000 H200 chips reportedly stockpiled in Hong Kong awaiting approval, access to the person who runs the company is worth a great deal.

Will there be Nvidia scam emails now? Almost certainly. Every major news story produces a wave of phishing within days — it happened with the Bitcoin crash, the Binance breach, and the Japan alert hack this week alone. Treat unsolicited "investor alert" or "board statement" emails about Nvidia with suspicion, and verify anything important on Nvidia's own site.

Can a temp mail address stop spear-phishing? No. It limits your exposure by keeping your real address out of breached databases and signup lists, which shrinks the surface attackers can reach. It does not authenticate senders or protect accounts. For anything involving money or identity, use your real address with a unique password and an authenticator app.

Should I use my real email for investing accounts? Yes. Brokerage and bank accounts should use your real, dedicated address — never a disposable one. If you lose access to a temporary inbox, you lose the recovery path to the account, and no broker will help you get it back.

The part that stays with me

The Nvidia story will be gossip by next week. Someone will make a joke about it, the stock will move on, and the investigation will grind on quietly behind closed doors. What will not change is the method. The most defended person in technology was approached through a person, not a firewall — and the cheap version of the same attempt lands in your inbox every single day, dressed up as a vendor, a bank, or a breaking-news alert.

You do not need a security budget to answer it. You need a habit: verify through a channel you opened, keep your real address away from signups that do not deserve it, and remember that the message knowing something true about you is not the same as the message being true. Huang's story is a reminder that nobody is too important to be approached — and yours is that nobody is too unimportant to be tried.