219,665 Patients' Before Photos Leaked. Passwords Reset; These Cannot
Disclosure: Some links on this page are affiliate links. If you purchase through them, we may earn a commission at no extra cost to you. Full affiliate disclosure.
Gangnam Unni is a South Korean platform that connects people with cosmetic surgery clinics. On September 4, 2026, an API used to look up consultation records was accessed abnormally. The operator, Healing Paper, blocked that route — and then found the same attacker trying a different path the next day.
The confirmed total is 219,665 affected users: roughly 160,000 in South Korea, 48,000 in Japan, 4,218 in Taiwan, 1,591 in Thailand, 481 in mainland China and 5,308 elsewhere.
The count is not what makes this one different. What makes it different is that the stolen data includes consultation photographs, the reason each person sought treatment, and how far along their treatment was. There is no reset for that.
Editor’s take: Medical photographs are a category apart, and the reason is that they cannot be reissued the way a card number can. That changes what victims need: not a password reset, but a route to get the material taken down and a realistic view of how widely it has spread. Watch for follow-on extortion using the images, which is the predictable second stage.
Editor's Take
The line that should stick is in the headline: passwords can be reset, photographs cannot. This is the category of breach where the usual advice is useless, because there is no credential to rotate and no way to unpublish the file. It also shows how much damage a single misused API can do without anyone "hacking" anything — authorisation failures look like normal traffic until the data is already out.
What Was Taken
The exposure splits into two layers, and the second one is the problem.
The first is ordinary identity data of the kind that appears in most breaches: name, phone number, email address, date of birth, gender, place of residence, social media account IDs, IP address and device details. Unpleasant, but familiar.
The second layer is specific to a medical aesthetics platform:
- the procedures each person enquired about
- the clinic and doctor names
- the stated reason for seeking treatment
- clinical progress notes
- uploaded consultation photographs
- appointment times
- procedures viewed, applied for and actually received
- treatment dates and payment information
Read that list as what an outsider can now reconstruct: this person's face before a procedure, what they wanted changed, where they had it done, and when. Korean media reporting noted that the data can reveal both health conditions and appearance insecurities.
Why "Change Your Password" Is Useless Here
Breach response advice is built around credentials, because credentials are replaceable. If a password leaks, you change it. If a card number leaks, the bank issues a new one. The whole playbook assumes the exposed secret can be revoked.
A photograph of your face has no revocation mechanism. Neither does the fact that you consulted about a specific procedure on a specific date. Those are permanent attributes, and once they are in a file with your name, phone number and date of birth attached, they are permanently linkable to you.
This is the same reason the IDScan driver's license breach was graver than its record count suggested. Government ID numbers cannot be reissued either. What is different here is the addition of imagery, which converts a fraud risk into a personal one.
The Extortion Angle Is Not Theoretical
South Korean security professionals quoted in local coverage warned about two follow-on attacks, and both follow directly from what was taken.
The first is impersonation. An attacker who knows your clinic, your doctor and your appointment timing can send a convincing message about a promotion, a follow-up visit or a billing issue. That message arrives with details no generic scammer would have.
The second is worse. The reported concern is that operators may threaten to publish pre-procedure photographs and treatment records unless payment is made. No such secondary harm had been reported at the time of disclosure — but the material required to attempt it is now in circulation, and for a platform whose users may not have disclosed these procedures to employers, family or partners, the use is obvious.
Healing Paper says it reported the incident to the Korea Internet & Security Agency and requested a police investigation. It has also opened a lookup on its official site, available for 30 days after the notice, where users can check whether they were affected.
An API, Not a Hack
The detail worth dwelling on is the entry point. This was not stolen credentials or an unpatched server — it was an API used to query consultation records being accessed in a way it was not intended to support.
That pattern keeps recurring, and it is harder to defend against than a missing patch because nothing is technically broken. The endpoint works as designed; it simply answers more questions than it should, to more callers than it should. Rate limiting and authorisation checks on object-level access are the controls that matter, and they tend to be added after an incident rather than before.
Note also the timing. The attacker came back through a second path the day after the first was closed. Whatever else this was, it was not opportunistic — someone knew the system well enough to have a fallback route ready.
What Affected Users Should Actually Do
- Use the official lookup, and only the official one. Healing Paper's 30-day window is on its own site. Any message offering to check for you is the attack, not the remedy.
- Treat clinic-branded contact as unverified by default. Real knowledge of your appointment is exactly what makes a convincing lure here. Navigate to the platform directly instead of following links.
- Expect extortion attempts, and do not engage. If you receive a message referencing photos or procedures, preserve it and report it rather than replying. Paying establishes that you are a viable target.
- Reduce the surrounding data. The reason a leak like this is dangerous is that it joins up with what brokers already sell. Our data removal services comparison covers what actually gets taken down, and our identity theft protection comparison is the version with monitoring attached.
- Check stealer logs separately. If your concern is account takeover, the useful question is whether your credentials appear in infostealer harvests. Our dark web monitoring guide explains how that works.
The part you can still control: how much is findable about you elsewhere. The photographs are gone, but removing broker records cuts the links an attacker would use to connect this file to your employer, your family and your accounts.
For the broader sequence after any exposure, our data breach response guide walks through triage in order.
The Honest Read
Gangnam Unni rebranded in July and announced overseas expansion. Two months later it is disclosing a breach of 219,665 users, including medical imagery, to a user base spread across Korea, Japan, Taiwan and Thailand. Growth and security investment were not moving at the same speed.
The general lesson is not "avoid medical platforms." It is that we have one breach response playbook and it does not fit every category. When the exposed data is a password, the playbook works. When it is a photograph of your face attached to the thing you were self-conscious about, the playbook has nothing to offer, and the only real defence was not storing it in a reachable place to begin with.
