Chinese Hackers Breached LoopPay for cyber espionage through Samsung Pay

Chinese Hackers who allegedly compromised servers at LoopPay, the Samsung subsidiary, appear interested in spying on targets through Samsung Pay technology.

The Samsung subsidiary LoopPay has been the victim of a security breach that is worrying the security industry. The investigators speculate that attackers’ motivation is the cyber espionage and excluded a financial crime.  If confirmed the security breach could have worse consequences.

The news that Chinese Hackers Breached LoopPay, the core of Samsung Pay system, has been provided by the The New York Times and has been confirmed by Samsung with an official statement.

“Today, the New York Times reported on an incident that targeted LoopPay’s office network. The article raised questions as to the effect of this on the recently launched Samsung Pay service. The first thing to know is that Samsung Pay was not impacted and at no point was any personal payment information at risk. This was an isolated incident that targeted the LoopPay office network, which is a physically separate network from Samsung Pay. The LoopPay incident was resolved and had nothing to do with Samsung Pay.” acknowledged  Samsung.

Samsung minimized the incident reporting that only LoopPay’s office network was affected, anyway, no personal payment information was exposed. Samsung added that systems at Samsung Pay haven’t been impacted.

The network at LoopPay was breached in February, shortly before Samsung bought the company for US$250 million. The experts believe that attackers have already breached the company at that time.

LoopPay did not learn of the breach until late August, when an organization came across LoopPay’s data while tracking the Codoso Group in a separate investigation.” states The New York Time.

According to The New York Times, the attack was conducted by the Chinese hackers belonging to the Codoso Group.  The Codoso group (aka Sunshop Group) hit Forbes visitors with zero-day exploits early this year, it is known in the security community for its attacks against against many entities in various industries including the US Government, Military, Defense Industrial, Think tanks covering foreign affairs, Financial services, Energy firms, and Political dissident groups.

The New York Times sustains the hackers did not act to steal consumer data for sale, it is likely they were interested in accessing to LoopPay’s code to develop the capability to collect information on individuals. The information managed by LoopPay could be used to trace “persons of interest,” knowing their purchases, habits and locations.

The security experts fear that the hackers of the Codoso group may have already infiltrated other systems inside their target, as usually happen when APT conduct long-term espionage campaigns.

“Once Codoso compromises their targets — which range from dissidents to C-level executives in the U.S. — they tend to stay there for quite a long time, building out their access points so they can easily get back in,” said John Hultquist, the head of intelligence on cyberespionage at iSight Partners, a security firm. “They’ll come back to a previous organization of interest again and again.”

Samsung Pay is a technology that allows to pay with your a mobile device, experts sustain that it is more secure than traditional credit cards because each transaction is associated with  a one time encrypted token.

LoopPay hasn’t notified law enforcement about the intrusion because it believed no customer data or financial information had been stolen.

Pierluigi Paganini

(Security Affairs – LoopPay , Samsung Pay)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

U.S. Treasury removed sanctions against the crypto mixer service Tornado Cash<gwmw style="display: none; background-color: transparent;"></gwmw>

The U.S. Treasury is lifting sanctions on Tornado Cash, a crypto mixer accused of helping…

4 hours ago

Zero-day broker Operation Zero offers up to $4 million for Telegram exploits

Russian zero-day broker Operation Zero is looking for exploits for the popular messaging app Telegram,…

21 hours ago

RansomHub affiliate uses custom backdoor Betruger<gwmw style="display:none;"></gwmw>

Symantec researchers linked a custom backdoor, called Betruger, found in recent ransomware attacks to an…

1 day ago

Cisco Smart Licensing Utility flaws actively exploited in the wild

Experts warn of the active exploitation of two recently patched security vulnerabilities affecting Cisco Smart…

2 days ago

Pennsylvania State Education Association data breach impacts 500,000 individuals

A data breach at the Pennsylvania State Education Association exposed the personal information of over…

2 days ago

Veeam fixed critical Backup & Replication flaw CVE-2025-23120

Veeam released security patches for a critical Backup & Replication vulnerability that could let attackers…

2 days ago

This website uses cookies.