Gangnam Unni breach exposes sensitive data of 220000 users

Unauthorized API access exposed users’ details, cosmetic consultation records, photos and payment information across several countries.

Personal information belonging to nearly 220,000 users in Korea and overseas has been leaked from Gangnam Unni, a platform for cosmetic medical services.

Leaked information includes not only names and phone numbers, but also records of which cosmetic surgery a user applied for, as well as photos they used to apply for consultations.

Healing Paper, the operator of Gangnam Unni, said in a notice Monday that some customers' personal information was exposed after unauthorized access to an application programming interface (API) linked to its consultation records occurred on Friday. Gangnam Unni is a well-known platform for finding information on cosmetic procedures and connecting users with clinics.

Weverse data leak affects 420,000 users

Weverse data leak affects 420,000 users

Tving opens compensation claims after data leak affecting 39.5 million accounts

Tving opens compensation claims after data leak affecting 39.5 million accounts

Nearly 40 million accounts compromised in Tving hack, investigation finds

Nearly 40 million accounts compromised in Tving hack, investigation finds

U.S. or Korea? Coupang's data breach lawsuit faces key jurisdiction question.

U.S. or Korea? Coupang's data breach lawsuit faces key jurisdiction question.

The company said it blocked the access route after detecting suspicious activity but found that the same attacker attempted to gain access again through a different route the following day.

A total of 219,665 users were affected. Korean users accounted for the largest at around 160,000, followed by 48,000 users in Japan, 4,218 in Taiwan, 1,591 in Thailand, 481 in China and 5,308 in English-speaking and other countries.

The leaked data included names, phone numbers, email addresses, dates of birth, sex, countries and areas of residence, social login IDs, IP addresses and device information.

The breach also exposed sensitive information, including promotions and procedures for which users had requested consultations, consultation status and photos submitted for consultations, as well as information procedures they had undergone and payment details.

Affected users were individually notified and given the option to check which of their data was exposed through the Gangnam Unni website for 30 days, Healing Paper said.

The company also urged users not to respond to text messages, phone calls or emails impersonating Gangnam Unni or medical clinics that offer discounts or information clinics while asking recipients to click links or provide personal or financial information.

BY KIM EUN-BIN [[email protected]]

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.