By 
A threat actor known as “888” has reportedly leaked sensitive data belonging to LG Electronics, triggering serious cybersecurity concerns.
The breach, which was first highlighted on November 16, 2025, allegedly includes source code repositories, configuration files, SQL databases, and hardcoded credentials and SMTP server details that could expose LG’s internal communications and development systems.
The leak appeared on ThreatMon, where “888” shared sample files to demonstrate authenticity. The data is said to originate from a contractor access point, suggesting a supply-chain weakness rather than a direct corporate intrusion.
Cybersecurity experts warn that hardcoded credentials within code can allow attackers to impersonate employees or move laterally into connected services. Exposed SMTP details could further enable phishing or spam campaigns masquerading as official LG emails.
The hacker “888” has a history of high-profile claims since at least 2024, targeting companies such as Microsoft, BMW Hong Kong, Decathlon, and Shell. Their operations typically involve infostealer malware, initial access brokers, and monetization through cryptocurrency. No ransom demand has been confirmed in this LG case.
Shared samples reportedly include directory structures indicating gigabytes of proprietary code, posing risks to LG’s intellectual property and product security.
LG Electronics has not yet issued a public statement. The incident comes shortly after LG Uplus confirmed a separate breach in October 2025, part of a broader wave of cyberattacks on South Korean telecom firms. Analysts speculate that unpatched cloud tools or third-party integrations may be contributing factors.
Security experts urge organizations to scan for leaked credentials using platforms like Have I Been Pwned and rotate any exposed keys immediately.
