A hacker alias 888 claimed responsibility for breaching Samsung Medison, a South Korean medical device subsidiary of Samsung, via a third-party contractor attack. The exposed data includes source code, private keys, SMTP credentials, hardcoded credentials, user PII (healthcare backup records), MSSQL database dumps, and AWS S3 cloud storage exports—all allegedly extracted and offered for sale on a cybercrime forum. Screenshots shared by the hacker reveal backend database content (SQL tables), employee/user records, internal logs, and cloud directories tied to Samsung Medison’s healthcare environment.The leaked data poses severe risks, including identity theft, targeted phishing, and follow-up cyber intrusions, given the sensitivity of healthcare-related PII (names, emails, country details, and system logs). The hacker, with a history of high-profile breaches (e.g., Microsoft and Nokia in 2024), demanded payment in Monero (XMR) for the one-time sale. Samsung has not yet confirmed the breach’s authenticity, but if validated, the incident could trigger regulatory penalties, reputational damage, and operational disruptions in critical medical imaging systems used globally in hospitals and clinics.