It seems that this is "normal" behaviour since the updates for SegWit were put in...
https://www.reddit.com/r/ledgerwallet/comments/6wws8e/comfirm_output_2/Chances are that this Output #2 is in fact a change address in your wallet, so I don't think that you need to worry that your ledger s might have been "hacked"

Checking your addresses is actually pretty easy, so if you need detailed step by step instructions, I'm sure one of us will be able to help out
