Shortly after teasing their followers, Lapsus$ disclosed details of an upcoming data leak, which reportedly contains "confidential Samsung source code" originating from a security breach. The leaked data is said to include sensitive information such as:
This data breach, if accurate, poses a significant threat to Samsung, as it exposes critical and sensitive information related to their technology and security infrastructure.
Lapsus$ distributed the leaked data in three compressed files totaling almost 190GB, making it available as a torrent with a high number of users sharing the content. The extortion group also mentioned plans to deploy additional servers to enhance download speeds.
The torrent includes a brief description of the content in each of the three archives:
It remains unclear whether Lapsus$ has contacted Samsung for ransom, as they previously claimed to have done in the case of Nvidia. This breach has the potential to inflict significant damage to Samsung's security and competitive standing.
- Source code for every Trusted Applet (TA) installed in Samsung's TrustZone environment, which is used for secure operations like hardware cryptography, binary encryption, and access control.
- Algorithms for all biometric unlock operations.
- Bootloader source code for recent Samsung devices.
- Confidential source code from Qualcomm.
- Source code for Samsung's activation servers.
- Full source code for technology used to authorize and authenticate Samsung accounts, including APIs and services.
This data breach, if accurate, poses a significant threat to Samsung, as it exposes critical and sensitive information related to their technology and security infrastructure.
Lapsus$ distributed the leaked data in three compressed files totaling almost 190GB, making it available as a torrent with a high number of users sharing the content. The extortion group also mentioned plans to deploy additional servers to enhance download speeds.
The torrent includes a brief description of the content in each of the three archives:
- Part 1 contains source code and related data regarding Security/Defense/Knox/Bootloader/TrustedApps and various other items.
- Part 2 contains source code and related data related to device security and encryption.
- Part 3 includes repositories from Samsung Github, such as mobile defense engineering, Samsung account backend, Samsung pass backend/frontend, and SES (Bixby, Smartthings, store).
It remains unclear whether Lapsus$ has contacted Samsung for ransom, as they previously claimed to have done in the case of Nvidia. This breach has the potential to inflict significant damage to Samsung's security and competitive standing.