"Even Photos Taken Before Plastic Surgery Were Exposed"... Gangnam Unni to Compensate 220,000 Users with 50,000 Won in Points Each

[Financial News] Healing Paper, the operator of the beauty-medical platform Gangnam Unni, announced a compensation plan for customers affected by a personal-information breach involving approximately 220,000 people. The company will provide each affected customer with points worth 50,000 won and offer insurance covering up to 10 million won in the event of financial fraud.
On the 9th, Healing Paper released a second statement on the personal-information breach, outlining compensation for affected customers and additional security measures.
Previously, an unauthorized access incident occurred in the API linked to Gangnam Unni’s consultation-record lookup function, resulting in the exposure of personal information belonging to 219,665 people, including approximately 160,000 in South Korea and 48,000 in Japan.
The exposed information included basic personal data such as names, phone numbers, email addresses, dates of birth, genders, countries and regions of residence, social-login IDs, and internal identification IDs.
It also included the medical institutions users consulted, consultation requests, whether procedures or surgeries had been performed or were scheduled, and information about desired procedures. For some users, photos uploaded during the consultation process and their reasons for seeking consultation were also exposed.
Healing Paper, which is compensating affected customers, said, "We will provide each customer in South Korea with 50,000 won in points." The company added, "Applications for the points will open at 10 a.m. on the 10th through a compensation-application link in the app." The amount to be provided to customers affected overseas will be announced later.
The company will also provide one year of insurance coverage of up to 10 million won per person if hacking, phishing, or other financial fraud resulting from the personal-information breach causes monetary losses.
Healing Paper stated, "We do not take this incident lightly and are devoting all our efforts to strengthening additional system and database security and monitoring to prevent secondary damage and a recurrence." It added, "Immediately after becoming aware of the incident, we blocked the problematic access route and inspected the entire system."
The company further explained, "We individually notified users whose information was exposed and enabled them to check which of their data had been exposed on the Gangnam Unni website for 30 days."
Specifically, Healing Paper has comprehensively strengthened its authentication and access-control systems to prevent a recurrence. It reorganized authentication procedures for logins and API calls into multiple stages and rebuilt its authorization-verification logic to block unauthorized access in advance. It also upgraded its real-time monitoring system for abnormal activity, establishing a response system capable of immediately detecting and blocking similar access patterns and repeated attack attempts.
In addition, the company is conducting comprehensive security inspections of all APIs and databases handling consultation, payment, and procedure information. It is also carrying out vulnerability assessments and simulated penetration tests with external security specialists.
Healing Paper reported the security incident to the Korea Internet & Security Agency (KISA) on the 6th and completed its report of the personal-information breach the following day, on the 7th. The company has also asked the police station with jurisdiction to investigate the cybercrime in order to identify the attacker and prevent a recurrence.
Aiden, CEO of Healing Paper, said, "We will take this incident as a painful lesson and continue strengthening our information-security investments and protective measures in accordance with the standards for the Information Security Management System (ISMS)." He added, "We will transparently and fully inform the public of the improvement process and its progress."
[email protected] Ahn Ga-eul Reporter