Personal Information of 220,000 'Gangnam Unni' Users Leaked...Procedure and Consultation Records Exposed

Personal information of 219,665 domestic and international users of the aesthetic medicine platform 'Gangnam Unni,' operated by Healing Paper, has been leaked. Beyond basic information such as names and contact numbers, sensitive data including consultation and booking records as well as actual procedure information have been exposed, raising concerns about secondary damage such as impersonation of hospitals or platforms.

Healing Paper announced through a website notice on the 7th that "on the 4th, an abnormal access attempt was made to the linked function (API) for querying consultation records, resulting in personal information leakage of some customers." The company said it immediately blocked the access route upon detecting abnormal signs. However, it confirmed that on the 5th, the same attacker attempted to access through a different route, which was also blocked.

The scale of the leak is largest among Korean users at approximately 160,000, followed by Japan with 48,000, Taiwan with 4,218, Thailand with 1,591, China with 481, and English-speaking and other countries with 5,308.

Leaked items include name, phone number, email, date of birth, gender, country of residence/region, social login ID, access IP, and device usage information. In particular, information such as the event name and procedure name for which users applied for consultation, hospital name, doctor's name, desired consultation time, consultation motivation, and consultation registration photos, as well as actual procedure details, date and time of visit and procedure, payment amount and method, have been partially exposed. Since this is information that can infer an individual's health status or appearance concerns, experts point out that if misused, it could lead to privacy violations and phishing damage.

Healing Paper has secured multiple circumstances to identify the attacker and requested a police investigation with the relevant precinct on the 6th. The company also self-reported the personal information leak to the Korea Internet & Security Agency (KISA). Affected users were individually notified, and the company has enabled users to check their leaked items on the Gangnam Unni website for 30 days.

Hong Seung-il, CEO of Healing Paper, said, "We are taking this incident seriously and will actively cooperate with police investigations and inquiries from relevant agencies," and "We will comprehensively re-examine the effectiveness of existing protective measures and swiftly implement measures to prevent recurrence."

The company urged users not to respond to text messages, phone calls, or emails impersonating Gangnam Unni or hospitals that offer discounts or hospital information while requesting link clicks or the provision of personal or financial information.