Company Details
lgenergysolution
6,924
88,759
325
lgensol.com
0
LG _2166372
In-progress

LG Energy Solution Company CyberSecurity Posture
lgensol.comLG Energy Solution leads the future eco-friendly energy industry by developing distinguished materials and next-generation batteries. As the only chemical-based battery company in the world, we are leading the global lithium-ion battery market based on distinguished materials technology. We have become a global powerhouse in the EV and energy storage system (ESS) battery sector. And based on our unparalleled technologies, we are actively developing new products and procuring global battery production capacities to enhance our dominance in the next-generation energy market.
Company Details
lgenergysolution
6,924
88,759
325
lgensol.com
0
LG _2166372
In-progress
Between 650 and 699

LES Global Score (TPRM)XXXX

Description: LG Energy Solution, a South Korean battery manufacturer specializing in lithium-ion batteries for electric vehicles (EVs) and energy storage systems, suffered a ransomware attack at one of its overseas facilities. The Akira ransomware group claimed responsibility, alleging the theft of **1.7TB of data**, including **employee records** (visas, US/Korean passports, medical documents, Korean ID cards, addresses, phones, emails) and **corporate documents** (confidential projects, NDAs, financials, client/partner information, contracts). The impacted facility was restored to normal operations, but the stolen data—if verified—poses risks of **phishing attacks**, **black-market sales**, or **further exploitation**. The headquarters and other facilities remained unaffected, though investigations are ongoing. The breach’s scale and the sensitivity of the leaked employee and corporate data heighten concerns over financial fraud, reputational damage, and operational disruptions.
Description: LG Energy Solution, a South Korea-based subsidiary of LG and one of the world’s largest battery manufacturers (earning $17.5 billion in 2024), confirmed a ransomware attack targeting a specific overseas facility. The Akira ransomware gang claimed responsibility, asserting they stole **1.7 terabytes of data**, including **corporate documents and employee databases**. While the headquarters and other facilities remained unaffected, the incident disrupted operations at the targeted site, requiring recovery measures before normal functionality resumed. The FBI had previously flagged Akira for its aggressive tactics, noting over **$244 million in ransom proceeds** and disruptions across critical sectors like manufacturing, hospitals, and schools. The attack underscores the growing threat to battery suppliers, following similar incidents like Varta AG’s weeks-long outage in 2023 and a $60 million theft from another key material supplier in 2024. LG is conducting investigations but has not disclosed further details about the breach’s scope or potential ransom demands.


LG Energy Solution has 0.0% fewer incidents than the average of same-industry companies with at least one recorded incident.
LG Energy Solution has 29.87% more incidents than the average of all companies with at least one recorded incident.
LG Energy Solution reported 1 incidents this year: 0 cyber attacks, 1 ransomware, 0 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.
LES cyber incidents detection timeline including parent company and subsidiaries

LG Energy Solution leads the future eco-friendly energy industry by developing distinguished materials and next-generation batteries. As the only chemical-based battery company in the world, we are leading the global lithium-ion battery market based on distinguished materials technology. We have become a global powerhouse in the EV and energy storage system (ESS) battery sector. And based on our unparalleled technologies, we are actively developing new products and procuring global battery production capacities to enhance our dominance in the next-generation energy market.


A trusted partner for millions of customers, Ecolab (NYSE:ECL) is a global sustainability leader offering water, hygiene and infection prevention solutions and services that protect people and the resources vital to life. Building on more than a century of innovation, Ecolab has annual sales of $16

Sika is a specialty chemicals company with a globally leading position in the development and production of systems and products for bonding, sealing, damping, reinforcing, and protection in the building sector and industrial manufacturing. Sika has subsidiaries in 102 countries around the world and

The Asahi Kasei Group contributes to life and living for people around the world. Since its foundation in 1922 with ammonia and cellulose fiber business, Asahi Kasei has consistently grown through the proactive transformation of its business portfolio to meet the evolving needs of every age. With mo
Covestro is one of the world’s leading manufacturers of high-quality polymer materials and their components. With its innovative products, processes and methods, the company helps enhance sustainability and the quality of life in many areas. Covestro supplies customers around the world in key indust

Sasol is a global chemicals and energy company. We harness our knowledge and expertise to integrate sophisticated technologies and processes into world-scale operating facilities. We safely and sustainably source, produce and market a range of high-quality products in 22 countries, creating value
Linde is a leading global industrial gases and engineering company with 2023 sales of $33 billion. We live our mission of making our world more productive every day by providing high-quality solutions, technologies and services which are making our customers more successful and helping to sustain, d

We are dsm-firmenich – innovators in nutrition, health, and beauty. We bring progress to life by combining the essential, the desirable, and the sustainable. From our master perfumers and flavorists to our expert nutritionists and scientists, our trailblazing teams work closely with customers, sup
Welcome to Solvay, where science and mastery come together, creating excellence that stands the test of time. With a 160-year legacy, we're not just innovators; we're on a constant journey of progress, mastering the essential elements of our world. We're all about revealing potentials, just like

Meet IFF: We boldly bring together science and creativity to create what the world needs. An industry leader in food, beverage, scent, health and biosciences, we create essential solutions – from global icons to unexpected innovations and experiences. Equal parts outspoken and analytical, our inte
.png)
The National Assembly's Science, ICT, Broadcasting, and Communications Committee will summon Coupang founder and Chairman Kim Bom-suk,...
LG Display has become the first in the display industry to obtain cybersecurity certification for automotive organic light-emitting diode...
South Korea's LG Chem Ltd said on Friday it plans to lower its stake in subsidiary LG Energy Solution to about 70% from around 80%,...
LG Energy Solution, a leading South Korean battery manufacturer with global operations, confirmed a significant ransomware incident...
LG Energy Solution, one of the world's largest battery manufacturers, confirmed it had been hit by a ransomware attack after a cybercriminal...
Major South Korean battery manufacturer LG Energy Solution had one of its overseas facilities disrupted by a ransomware intrusion,...
LG Energy Solution suffered ransomware at one overseas facility, now restored and under investigation; Akira claims theft of 1.7TB data,...
A "specific overseas facility" fell prey to a ransomware attack but is now operating normally, according to LG Energy Solution — the South...
Canada's energy grid is evolving, with battery storage and cybersecurity converging to create a more resilient, intelligent infrastructure.

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
The official website of LG Energy Solution is https://www.lgensol.com/en/index.
According to Rankiteo, LG Energy Solution’s AI-generated cybersecurity score is 692, reflecting their Weak security posture.
According to Rankiteo, LG Energy Solution currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
According to Rankiteo, LG Energy Solution is not certified under SOC 2 Type 1.
According to Rankiteo, LG Energy Solution does not hold a SOC 2 Type 2 certification.
According to Rankiteo, LG Energy Solution is not listed as GDPR compliant.
According to Rankiteo, LG Energy Solution does not currently maintain PCI DSS compliance.
According to Rankiteo, LG Energy Solution is not compliant with HIPAA regulations.
According to Rankiteo,LG Energy Solution is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
LG Energy Solution operates primarily in the Chemical Manufacturing industry.
LG Energy Solution employs approximately 6,924 people worldwide.
LG Energy Solution presently has no subsidiaries across any sectors.
LG Energy Solution’s official LinkedIn profile has approximately 88,759 followers.
LG Energy Solution is classified under the NAICS code 325, which corresponds to Chemical Manufacturing.
Yes, LG Energy Solution has an official profile on Crunchbase, which can be accessed here: https://www.crunchbase.com/organization/lg-energy-solution.
Yes, LG Energy Solution maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/lgenergysolution.
As of December 11, 2025, Rankiteo reports that LG Energy Solution has experienced 2 cybersecurity incidents.
LG Energy Solution has an estimated 4,203 peer or competitor companies worldwide.
Incident Types: The types of cybersecurity incidents that have occurred include Ransomware.
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with isolation of affected facility, and remediation measures with security measures implemented, remediation measures with investigation conducted, and recovery measures with facility restored to normal operations, and communication strategy with public statement confirming attack, communication strategy with limited details shared, and and containment measures with isolation of affected facility, containment measures with mitigation of attack spread, and remediation measures with recovery of impacted systems, remediation measures with security operations enhancement, and recovery measures with restoration of facility operations to normal, and communication strategy with public statement confirming attack and mitigation, communication strategy with no further details disclosed during investigation, and enhanced monitoring with precautionary security operations ongoing..
Title: LG Energy Solution Ransomware Attack by Akira Gang
Description: LG Energy Solution, one of the world’s largest battery makers, confirmed a ransomware attack by the Akira gang, which claimed to have stolen 1.7 TB of data, including corporate documents and employee databases. The attack targeted a specific overseas facility, which has since been recovered and is operating normally. The company is conducting security investigations as a precautionary measure.
Type: ransomware
Threat Actor: Akira ransomware gang
Motivation: financial gaindata theft
Title: Ransomware Attack on LG Energy Solution Overseas Facility
Description: LG Energy Solution, a South Korean battery manufacturer and subsidiary of LG, confirmed a ransomware attack targeting one of its overseas facilities. The attack was mitigated, and the facility is now operational. The Akira ransomware group claimed responsibility, alleging the theft of ~1.7TB of data, including employee records, corporate documents, and SQL databases. The stolen data could be used for phishing or sold on the dark web for significant profit. LG is investigating the incident but has not confirmed the extent of the breach.
Type: ransomware
Threat Actor: Akira
Motivation: financial gaindata theft
Common Attack Types: The most common types of attacks the company has faced is Ransomware.

Data Compromised: Corporate documents, Employee information databases
Systems Affected: specific overseas facility
Operational Impact: temporary disruption (facility recovered and operating normally)
Brand Reputation Impact: potential reputational damage due to data breach and ransomware association
Identity Theft Risk: high (employee information compromised)

Data Compromised: Employee personal information (visas, us/korean passports, medical documents, korean id cards, addresses, phones, emails), Confidential projects, Ndas, Confidentiality agreements, Detailed financials, Client/partner information, Contracts, Sql databases
Systems Affected: one specific overseas facility
Operational Impact: Facility temporarily disrupted; now restored to normal operations
Brand Reputation Impact: Potential reputational damage due to data exposure and ransomware association
Identity Theft Risk: High (due to exposure of PII like passports, ID cards, medical records)
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Corporate Documents, Employee Information, , Employee Pii, Corporate Documents, Financial Records, Contracts, Ndas, Sql Databases and .

Entity Name: LG Energy Solution
Entity Type: subsidiary (of LG Corp)
Industry: battery manufacturing
Location: South Korea (HQ)overseas facility (unspecified)facilities in North America (8) and other continents
Size: large (global, $17.5B revenue in 2024)

Entity Name: LG Energy Solution
Entity Type: Subsidiary (of LG Corporation)
Industry: automotive (EV batteries), energy storage systems, consumer electronics
Location: South Korea
Size: Large (global operations, $17B+ revenue in 2024)

Incident Response Plan Activated: True
Containment Measures: isolation of affected facility
Remediation Measures: security measures implementedinvestigation conducted
Recovery Measures: facility restored to normal operations
Communication Strategy: public statement confirming attacklimited details shared

Incident Response Plan Activated: True
Containment Measures: Isolation of affected facilityMitigation of attack spread
Remediation Measures: Recovery of impacted systemsSecurity operations enhancement
Recovery Measures: Restoration of facility operations to normal
Communication Strategy: Public statement confirming attack and mitigationNo further details disclosed during investigation
Enhanced Monitoring: Precautionary security operations ongoing

Type of Data Compromised: Corporate documents, Employee information
Sensitivity of Data: high (employee PII and corporate data)

Type of Data Compromised: Employee pii, Corporate documents, Financial records, Contracts, Ndas, Sql databases
Sensitivity of Data: High (includes passports, medical records, financials, confidential agreements)
Data Exfiltration: Claimed: ~1.7TB (1.67TB corporate documents + 46GB SQL databases)
File Types Exposed: documentsdatabases (SQL)PDFs (likely for contracts/NDAs)image files (scans of passports/ID cards)
Personally Identifiable Information: full namespassport numbersKorean ID numbersaddressesphone numbersemail addressesmedical documentsvisa information
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: security measures implemented, investigation conducted, , Recovery of impacted systems, Security operations enhancement, .
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by isolation of affected facility, , isolation of affected facility, mitigation of attack spread and .
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through facility restored to normal operations, , Restoration of facility operations to normal, .

Source: FBI Advisory on Akira Ransomware
Date Accessed: 2023-11-13

Source: LG Energy Solution Spokesperson Statement

Source: Akira Ransomware Leak Site

Source: The Record

Source: TechRadar
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: FBI Advisory on Akira RansomwareDate Accessed: 2023-11-13, and Source: LG Energy Solution Spokesperson Statement, and Source: Akira Ransomware Leak Site, and Source: The Record, and Source: TechRadar.

Investigation Status: ongoing (precautionary security operations and investigations)

Investigation Status: Ongoing (LG Energy Solution conducting security operations and investigations)
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Statement Confirming Attack, Limited Details Shared, Public Statement Confirming Attack And Mitigation and No Further Details Disclosed During Investigation.

High Value Targets: Employee Databases, Corporate Documents,
Data Sold on Dark Web: Employee Databases, Corporate Documents,

High Value Targets: Employee Databases, Financial Records, Confidential Agreements,
Data Sold on Dark Web: Employee Databases, Financial Records, Confidential Agreements,
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Precautionary security operations ongoing.
Last Attacking Group: The attacking group in the last incident were an Akira ransomware gang and Akira.
Most Significant Data Compromised: The most significant data compromised in an incident were corporate documents, employee information databases, , employee personal information (visas, US/Korean passports, medical documents, Korean ID cards, addresses, phones, emails), confidential projects, NDAs, confidentiality agreements, detailed financials, client/partner information, contracts, SQL databases and .
Most Significant System Affected: The most significant system affected in an incident was specific overseas facility and one specific overseas facility.
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were isolation of affected facility and Isolation of affected facilityMitigation of attack spread.
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were NDAs, SQL databases, client/partner information, confidential projects, employee personal information (visas, US/Korean passports, medical documents, Korean ID cards, addresses, phones, emails), confidentiality agreements, contracts, detailed financials, corporate documents and employee information databases.
Most Recent Source: The most recent source of information about an incident are TechRadar, LG Energy Solution Spokesperson Statement, Akira Ransomware Leak Site, The Record and FBI Advisory on Akira Ransomware.
Current Status of Most Recent Investigation: The current status of the most recent investigation is ongoing (precautionary security operations and investigations).
.png)
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak default password. By default, this is a 6 digit numeric value which can be brute forced. (This is the app_password parameter). Depending on local configuration, this password could be the extension, voicemail, user manager, DPMA or EPM phone admin password. This issue is fixed in versions 16.0.96 and 17.0.10.
Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the caller using PDO::prepare() + execute() without semantic restrictions. This is consistent with the name (“write tool”), but in an LLM/agent context it becomes a high-risk capability: prompt injection or indirect prompt manipulation can cause execution of destructive queries such as DROP TABLE, TRUNCATE, DELETE, ALTER, or privilege-related statements (subject to DB permissions). Deployments that expose an agent with MySQLWriteTool enabled to untrusted input and/or run the tool with a DB user that has broad privileges are impacted. This issue is fixed in version 2.8.12.
Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. MySQLSelectTool is intended to be a read-only SQL tool (e.g., for LLM agent querying, however, validation based on the first keyword (e.g., SELECT) and a forbidden-keyword list does not block file-writing constructs such as INTO OUTFILE / INTO DUMPFILE. As a result, an attacker who can influence the tool input (e.g., via prompt injection through a public agent endpoint) may write arbitrary files to the DB server if the MySQL/MariaDB account has the FILE privilege and server configuration permits writes to a useful location (e.g., a web-accessible directory). This issue is fixed in version 2.8.12.
Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. This issue is fixed in version 20.0.1.
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. This issue is fixed in versions 4.11.2 and 4.12.1.

Get company history
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.