Hackers leak 190 GB of alleged Samsung data and source code

  • 14 March 2022
  • 2 min read

Recently, the data extortion gang Lapsus$ published a massive collection of confidential data, claiming to be from Samsung Electronics, the South Korean consumer electronics behemoth.

Lapsus$ released a 20GB document collection from 1TB of data taken from Nvidia GPU designer less than a week ago.

The extortion gang teased about revealing Samsung data with a snapshot of C/C++ instructions in Samsung software in a previous note.

Lapsus$ issued a summary of the imminent leak shortly after tantalizing their followers, claiming that it contained "secret Samsung source code" stemming from a breach.

  • Source code for every Trusted Applet (TA) installed in Samsung’s TrustZone environment used for sensitive operations (e.g. hardware cryptography, binary encryption, access control)

  • Algorithms for all biometric unlock operations

  • Bootloader source code for all recent Samsung devices

  • Confidential source code from Qualcomm

  • Source code for Samsung’s activation servers

  • Full source code for technology used for authorizing and authenticating Samsung accounts, including APIs and services

If the information above is correct, Samsung has had a big data breach that could result in significant financial loss.

Lapsus$ divided the disclosed data into three compressed files totaling about 190GB and uploaded them to a torrent that appears to be very popular, with over 400 peers spreading the content. The extortion organization further stated that it would boost the download speed by deploying more servers.

A brief explanation of the content contained in each of the three vaults is also included in the torrent:

Part 1 contains a source code dump as well as other information about Security/Defense/Knox/Bootloader/TrustedApps and other topics.

Part 2 includes a source code dump as well as info on device security and encryption.

Samsung GitHub repositories for mobile defensive engineering, Samsung account backend, Samsung pass backend/frontend, and SES are all included in Part 3. (Bixby, Smartthings, store)

It's unknown if Lapsus$ attempted to contact Samsung for a ransom, like they did with Nvidia.

For more information visit us on: www.nexixsecuritylabs.com

To schedule an audit you can contact us at: contact@nexixsecuritylabs.com

Your Security | Our Concern

All research

Cookie preferences

Choose what this site may store on your device. Your choice is remembered for six months and you can change it any time from the footer. Nothing in the optional categories is stored until you turn it on.

Always active

Needed for the site to work and to remember this choice. It is a single first-party cookie recording which categories you allowed. It carries no identifier and is never sent to anyone else.

Google Analytics and PostHog, so we can see which pages are read and where people give up. This is what lets us recognise one visit across several pages instead of counting every page as a new person. Records are anonymous — we never attach your name or email, and form fields are masked before anything is recorded.

Lets Google measure whether an ad we paid for led to an enquiry, and build audiences for future campaigns. Turning this off does not change what you see on this site.