You have to verify what I write below yourself, as I have no access to your ledger, but I can bet that the second output you are seeing was spent to the change address contained in your ledger too. So it was not hacked, rather it is the way the device, the wallet and LTC transactions in general work.