Personal Information of 220,000 'Gangnam Unni' Users Leaked... Procedure and Consultation Records Exposed

Personal information of 219,665 domestic and international users of beauty medical platform 'Gangnam Unni' operated by Healing Paper has been leaked. In addition to basic information such as names and contact numbers, sensitive details including consultation and reservation records and actual procedure information have been exposed, raising concerns about secondary damage through hospital or platform impersonation.

Healing Paper announced through a homepage notice on the 7th that "on the 4th, abnormal access was attempted to the linked function (API) for inquiring consultation records, resulting in personal information leakage of some customers." The company stated that upon detecting anomalies, it immediately blocked the access route, but confirmed that on the 5th, the same attacker attempted re-access through a different route, which was blocked.

The scale of the leak is largest among Korean users with approximately 160,000, followed by 48,000 from Japan, 4,218 from Taiwan, 1,591 from Thailand, 481 from China, and 5,308 from English-speaking and other countries.

Leaked items include name, phone number, email, date of birth, gender, country and region of residence, social login ID, access IP, and device usage information. Particularly, the event and procedure name for which users applied for consultation, hospital name, doctor's name, desired appointment time, consultation motivation, consultation registration photos, as well as actual procedure details, hospital visit and procedure date and time, payment amount and method were partially leaked. Experts point out that since this information can infer an individual's health condition or cosmetic concerns, if misused, it could lead to privacy violations and phishing damage.

Healing Paper secured multiple circumstances allowing identification of the attacker and requested police investigation on the 6th, while filing a voluntary report to the Korea Internet & Security Agency (KISA) regarding the personal information leak. Affected users were individually notified, and Gangnam Unni's homepage has made it possible for users to check their leaked information for 30 days.

Healing Paper CEO Hong Seung-il said, "We are taking this incident seriously and will actively cooperate with police investigations and related agency inquiries," and "We will comprehensively re-examine the effectiveness of existing protective measures and promptly implement measures to prevent recurrence."

The company requested users not to respond to text messages, phone calls, or emails impersonating Gangnam Unni or hospitals offering discount benefits or hospital guidance and requesting links to be clicked or personal and financial information to be provided.