Gangnam Unni Suffers Personal Data Leak Involving 220,000 Users, Raising Concerns Over Secondary Damage

Personal information of approximately 220,000 domestic and international users has been leaked from Healing Paper, the operator of the medical aesthetics platform Gangnam Unni.

Concerns are rising over potential secondary damage, such as phishing scams impersonating hospitals or the platform, as the leaked data includes counseling and reservation details as well as actual procedure information.

Healing Paper announced through a notice on September 7 that abnormal access occurred on September 4 targeting an application programming interface (API) used to retrieve consultation records, resulting in the leakage of some customer personal information.

Healing Paper explained that after detecting suspicious signs, it blocked the access route, but also confirmed that the same attacker attempted another access via a different route on September 5.

According to Healing Paper, the total number of affected individuals was tallied at 219,665. South Korean users accounted for the largest share at approximately 160,000, followed by 48,000 in Japan, 4,218 in Taiwan, 1,591 in Thailand, 481 in China, and 5,308 in English-speaking and other countries.

The leaked items include names, phone numbers, email addresses, dates of birth, genders, countries and regions of residence, social network login IDs, connection IP addresses, and device information.

Notably, the leaked data also included events and procedure names for which users requested consultations, hospital names, doctor names, preferred reservation times, consultation motives and progress statuses, and consultation registration photos.

Some information regarding interests, applications, actual procedure details, dates and times of hospital visits and procedures, names of performing doctors, and payment amounts, methods, and times was also leaked.

Because this is sensitive information that can allow inferences about an individual's health status or appearance-related concerns, concerns have been raised that if the leaked information is abused, it could lead to privacy violations and phishing damages.

Healing Paper stated that it has individually notified the affected users and made it possible for them to check their specific leaked items on the Gangnam Unni website for 30 days.

The company also urged users not to respond to text messages, phone calls, or emails that impersonate Gangnam Unni or hospitals, offer discounts or hospital guidance, and demand clicking links or providing personal and financial information.

(Photo: Capture of Gangnam Unni website, Yonhap News)
※ Please note: This article was translated by AI and may contain errors.