When Nvidia CEO Jensen Huang left the company in November 2024 over growing questions about his extramarital relationships—including one with an executive at Megaspeed, a Singapore data center company under federal investigation for allegedly funneling Nvidia chips to China—the circumstances exposed potential security vulnerabilities at one of the world's most critical AI infrastructure providers.

The incident raises broader questions about how corporations handle security risks when executives face potential foreign intelligence threats and export control scrutiny.

A Timeline of Troubling Transitions

The leadership changes at Nvidia unfolded with striking timing. David Reber, the company's Chief Security Officer for four years and seven-year veteran of the organization, stepped down in August 2024, citing a young-onset Parkinson's diagnosis. His replacement, Saša Zdjelar—who brought 17 years of experience from ExxonMobil along with stints at Salesforce and ReversingLabs—had barely settled into the role when Huang left the company just 2.5 months later.

According to TechCrunch, Nvidia's top lawyer had been engaged with the government's Megaspeed inquiry for over a year before Huang's departure. Five Nvidia employees confirmed Huang's relationship with a vice president who reported directly to him, while Reuters reported a second relationship with another employee. The Megaspeed connection proved particularly concerning given the company's suspected role in diverting advanced chips to China, potentially circumventing U.S. export controls designed to limit Beijing's access to cutting-edge AI technology.

Nothing public connects the security leadership changes to the Megaspeed matter, but the timing raises questions about what Nvidia's security team knew about the government's scrutiny and whether anyone raised concerns.

The Foreign Intelligence Threat Corporations Face

Nicholas Eftimiades, a retired senior intelligence officer and author of "Chinese Espionage Operations and Tactics" (2020) who has trained over 1,000 corporate security professionals, told TechCrunch that he estimates U.S. industry has lost "trillions [of dollars] in intellectual property" to foreign intelligence operations. Modern tactics, he explained, cultivate targets over years rather than the weeks typical of Soviet-era approaches, focusing on policy insight and export rule changes alongside traditional technology theft.

According to Eftimiades, the surveillance tools available to state actors have become alarmingly accessible. IMSI catchers—devices that mimic cell towers to intercept communications—cost approximately $1,000 for basic versions, with government-grade models commanding significantly higher prices. Eftimiades noted that such technology factored into Chinese espionage cases as recently as last year.

Security specialists say any affair—even one inside the office—can give a foreign intelligence service leverage over an executive who wants it kept quiet. Huang's relationship with an executive at Megaspeed, a company under federal investigation, raised particular concerns beyond typical office matters.

The Underfunded Security Problem

Part of the challenge stems from how corporations prioritize security investments. According to Eftimiades, security teams often remain underfunded because they don't directly drive revenue. CEOs commonly respond to security warnings with "not a nickel more than compliance," leaving teams stretched thin when facing sophisticated nation-state threats.

Many companies also define security too narrowly, specialists say. In an opinion piece in The Hill, Don Aviv, CEO of the corporate investigations firm Interfor International, and author Jeremy Hurewitz wrote that "too many companies still approach security primarily as a matter of protecting facilities, preventing cyberattacks, and responding to physical threats." They argued that security teams need to pay greater attention to insider threats, including the cultivation of executives by foreign intelligence services, suspicious business relationships, and conflicts of interest.

Eftimiades explained that spotting the clues isn't easy. Intelligence services collect information largely through everyday conversation rather than hacking, making it especially difficult for security teams to identify risks. What rival intelligence services often want is less technology than policy insight—who's pushing to change export rules and who the biggest blocker is.

The Broader Wake-Up Call

Some people inside Nvidia clearly knew parts of the picture. Reports about Huang's relationships with employees suggest colleagues were aware of them, even if the behavior is not expressly forbidden by Nvidia's code of conduct. What remains unclear is whether any of that information reached the security team, and if so, whether they could have acted on it.

Eftimiades said he hopes the episode is "a wake-up call" for U.S. industry, which he characterized as mostly "clueless" about China's tactics. What Nvidia's security team knew, and whether it could have acted on it, will only become clearer as the board's independent investigation and federal inquiries proceed.

Editor's Note: While the Nvidia case involves a major supplier of AI infrastructure used across multiple industries including healthcare, the source article discusses corporate security challenges broadly rather than sector-specific implications. Healthcare organizations and other enterprises that rely on critical technology suppliers may wish to consider these security dynamics when conducting vendor due diligence.

Sources

  1. Where was Nvidia's security team? — TechCrunch