A threat actor known as '888' leaked sensitive internal data from LG Electronics, including **source code repositories, configuration files, SQL databases, hardcoded credentials, and SMTP server details**. The breach, disclosed on **November 16, 2025**, originated from a **contractor access point**, highlighting a **supply-chain vulnerability**. Exposed credentials and SMTP details risk enabling **lateral movement, phishing, and impersonation attacks**, while leaked proprietary code threatens **intellectual property and product security**. The hacker shared sample files on **ThreatMon** to prove authenticity, with no confirmed ransom demand. The incident follows a separate breach at **LG Uplus (October 2025)**, suggesting broader targeting of South Korean telecom firms. Analysts suspect **unpatched cloud tools or third-party integrations** as potential attack vectors. LG has not issued a public response, but experts advise immediate **credential rotation and exposure checks** via platforms like *Have I Been Pwned*.
Source: https://cybersafe.news/lg-source-code-and-credentials-allegedly-leaked-by-hacker/
TPRM report: https://www.rankiteo.com/company/lg-electronics
"id": "lg-1232512111725",
"linkid": "lg-electronics",
"type": "Breach",
"date": "10/2025",
"severity": "85",
"impact": "",
"explanation": "Attack with significant impact with customers data leaks: - Attack which causes leak of personal information of customers (only if no ransomware) - Attack by hackers which causes data leak of customer information (only if no ransomware)"{'affected_entities': [{'industry': 'consumer electronics',
'location': 'South Korea',
'name': 'LG Electronics',
'type': 'corporation'}],
'attack_vector': ['supply-chain compromise (contractor access)',
"infostealer malware (historical TTP of '888')"],
'data_breach': {'data_exfiltration': True,
'file_types_exposed': ['code repositories',
'config files',
'SQL databases'],
'sensitivity_of_data': 'high (proprietary code, internal '
'communications, credentials)',
'type_of_data_compromised': ['source code',
'configuration files',
'database records (SQL)',
'credentials (hardcoded)',
'SMTP server details']},
'date_detected': '2025-11-16',
'date_publicly_disclosed': '2025-11-16',
'description': "A threat actor known as '888' leaked sensitive data belonging "
'to LG Electronics, including source code repositories, '
'configuration files, SQL databases, hardcoded credentials, '
'and SMTP server details. The breach was first highlighted on '
'November 16, 2025, and the data was shared on ThreatMon to '
'demonstrate authenticity. The leak is believed to originate '
'from a contractor access point, indicating a supply-chain '
'vulnerability. The exposed data poses risks such as lateral '
'movement, phishing, and intellectual property theft. No '
'ransom demand has been confirmed.',
'impact': {'brand_reputation_impact': 'high (due to exposure of proprietary '
'data and potential for follow-on '
'attacks)',
'data_compromised': ['source code repositories',
'configuration files',
'SQL databases',
'hardcoded credentials',
'SMTP server details'],
'identity_theft_risk': 'potential (via hardcoded credentials)',
'operational_impact': ['risk of impersonation attacks',
'phishing/spam campaigns via exposed SMTP',
'intellectual property exposure'],
'systems_affected': ['internal communications systems',
'development systems',
'potentially connected services (lateral '
'movement risk)']},
'initial_access_broker': {'entry_point': 'contractor access',
'high_value_targets': ['source code repositories',
'internal communications '
'systems']},
'investigation_status': 'ongoing (no public statement from LG Electronics as '
'of reporting)',
'motivation': ['financial gain (historical monetization via cryptocurrency)',
'reputation (high-profile targeting)'],
'post_incident_analysis': {'root_causes': ['supply-chain vulnerability '
'(contractor access)',
'hardcoded credentials in code',
'potential unpatched cloud tools']},
'ransomware': {'data_exfiltration': True},
'recommendations': ['Audit and remove hardcoded credentials in source code',
'Strengthen supply-chain security (contractor access '
'controls)',
'Monitor for exposed credentials using tools like Have I '
'Been Pwned',
'Rotate all potentially compromised keys and credentials',
'Enhance detection for infostealer malware and initial '
'access brokers',
'Review cloud tool patching and third-party integration '
'security'],
'references': [{'date_accessed': '2025-11-16',
'source': 'ThreatMon (leak publication platform)'},
{'date_accessed': '2025-11',
'source': 'Cybersecurity analysts (speculative commentary on '
'cloud tools/third-party risks)'},
{'source': "Historical reporting on '888' (Microsoft, BMW Hong "
'Kong, Decathlon, Shell breaches)'}],
'response': {'remediation_measures': ['experts recommend scanning for leaked '
'credentials (e.g., Have I Been Pwned)',
'rotating exposed keys']},
'threat_actor': '888',
'title': "LG Electronics Data Leak by Threat Actor '888'",
'type': ['data breach', 'supply-chain attack', 'unauthorized disclosure'],
'vulnerability_exploited': ['hardcoded credentials in source code',
'unpatched cloud tools (speculated)',
'third-party integrations (speculated)']}