South American hacking group $Lapsus has leaked a huge trove of confidential data it says is from Samsung, the South Korean consumer electronics giant.
The leak comes less than a week after $Lapsus released a 20GB document archive out of 1TB of data stolen from Nvidia, the GPU design company.
The hacking group learned about the Samsung data release through a screenshot of the C and C++ programming directives in Samsung software.
$Lapsus posted a description of the upcoming leak shortly after teasing their followers. It said it contained secret Samsung source code that is obtained through the security breach.
The leak also appears to contain confidential data from Qualcomm. The description by the group includes:
- The source code for each trusted TA applet installed in the Samsung TrustZone environment used for sensitive operations (eg hardware encryption, binary encryption, access control).
- The source code for the boot manager of all recent Samsung devices and the company’s activation servers, as well as the full source code for the technology used to authenticate with Samsung accounts, including APIs and services.
- Algorithms for all biometric unlocking operations.
- Secret source code from Qualcomm.
If the above details are accurate, it means that the company has been exposed to a major data breach that could cause serious damage to the company.
$Lapsus split the leaked data into three zip files that together have a size of approximately 190 GB. The group made the files available via a torrent file. The group also said it may add more servers to increase download speed.
The first part contains a dump of the source code and related data about security, protection, Boot Manager, Knox, TrustedApps, and various other items.
Samsung says it is assessing the situation
The second part contains a dump of the source code and related data about device security and encryption. While the third part contains different repositories from Samsung Github.
According to The Korean Herald, the South Korean company is assessing the situation.
$Lapsus has claimed responsibility for the Nvidia data breach. She said she obtained nearly 1 terabyte of confidential data from Nvidia. Including schematics and source code for drivers.
The group demanded that Nvidia provide the source code for the drivers. It also demanded that it remove the crypto-mining limiter from RTX 30-series GPUs.
It is not clear what the group might claim from Samsung. The group previously said its actions were not politically motivated.
