Hackers Allegedly Claim Leak of LG Source Code, SMTP, and Hardcoded Credentials

A threat actor known as “888” has purportedly dumped sensitive data stolen from electronics giant LG Electronics, raising alarms in the cybersecurity community.

The breach, first spotlighted on November 16, 2025, allegedly includes source code repositories, configuration files, SQL databases, and, critically, hardcoded credentials and SMTP server details potentially exposing LG’s internal communications and development pipelines to widespread exploitation.​

The leak surfaced via a post on ThreatMon, a platform that tracks dark web activity, where “888” shared samples to prove authenticity. Described as originating from a contractor access point, the dataset reportedly spans multiple LG systems, hinting at a supply chain vulnerability rather than a direct corporate hack.

LG Data Leak Claim

Cybersecurity analysts note that hardcoded credentials embedded directly in code for convenience pose severe risks, as they could enable attackers to impersonate LG personnel or pivot to connected services.

SMTP credentials, which manage email routing, might further allow phishing campaigns or spam operations disguised as legitimate LG correspondence.​

Threat actor “888” is no stranger to high-profile claims. Active since at least 2024, this individual has targeted entities like Microsoft, BMW Hong Kong, Decathlon, and Shell, often extorting ransoms or selling data on breach forums.

Their tactics typically involve initial access brokers and infostealer malware, and they monetize leaks through cryptocurrency payments. In this LG incident, no ransom demand has been publicly confirmed.

Still, samples shared include file structures suggesting the presence of gigabytes of proprietary code, which could undermine LG’s intellectual property in consumer electronics and smart appliances.​

LG Electronics has yet to issue an official statement, but the timing aligns with a turbulent year for the company. Earlier in October 2025, LG’s telecom arm, LG Uplus, confirmed a separate breach affecting customer data, amid a wave of South Korean telecom hacks.

LG Electronics confirmed to Cybersecuritynews “that the personal information of 584 employees from LG Electronics and HiPLAZA (LGE’s official distributor in Korea) — including names, company email addresses, and mobile phone numbers — stored on a website used for collaboration on domestic store design materials in Korea, was exposed externally at approximately 11 p.m. on January 16”.

“The incident occurred after the server of Nine Five, a development partner of HSAd, which had been commissioned by LG Electronics to develop the website, was compromised in a hacking attack. The partner’s server contained an authentication key that allowed access to the website.”

“Upon confirming the incident, LG Electronics immediately initiated the necessary response procedures in accordance with applicable regulations. The company will report the personal information breach to the relevant authorities, including the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission, within the required 72-hour window, and will notify the affected individuals directly.”

“LG Electronics is conducting a thorough investigation into the incident and is taking all appropriate measures to prevent any recurrence.”

Experts speculate these incidents may share common vectors, such as unpatched vulnerabilities in cloud integrations or third-party tools. The exposure of source code could reveal flaws in LG’s IoT devices, amplifying risks for millions of users worldwide.​

As investigations unfold, security firms urge organizations to scan for leaked credentials using tools like Have I Been Pwned and to rotate all suspected keys immediately.

This alleged breach underscores the fragility of global supply chains, where a single contractor’s lapse can cascade into corporate espionage. For LG, swift disclosure and remediation will be key to mitigating fallout amid relentless cyber threats.​

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.