“If you don’t send money, I’ll release your girlfriend’s breast surgery photos” ... Personal data leaked at Gangnam plastic surgery clinic

[Financial News] Photos of a patient’s body and personal information were leaked from a large plastic surgery clinic in Seoul’s Gangnam district after the patient underwent breast augmentation, and the information was used for extortion. The clinic is confirmed to have experienced multiple personal data breaches this year alone.

According to a KBS report on the 30th, A, an office worker in her 30s, underwent breast augmentation at a plastic surgery clinic in Seoul’s Gangnam district last month.
A month after the surgery, however, a message from an unidentified person arrived for A’s boyfriend. It included photos of A’s face and bare upper body, as well as a consultation form containing personal information such as her name and address.
The extortionist claimed the materials were some of the personal information leaked from the clinic and threatened, “I’ll post them on social media (SNS) in six days.” The extortionist then demanded that her boyfriend send cryptocurrency worth 1 million won if she did not want the materials made public.
A recalled how she felt at the time, saying, “I suddenly broke out in a cold sweat” and “I was gripped by the fear that all the photos might have been leaked to people I know.”

A contacted the clinic just 10 minutes after receiving the extortion message. The clinic said it had confirmed signs on the 11th that malware had been inserted into its internal server and personal information had been leaked, and shared an apology it had posted on its website 10 days earlier.
A claimed that the clinic had said, “‘Aren’t we victims too?’” and that she had received the reply, “We’ve referred the matter to the relevant agencies and an investigation is underway, so please wait.”
The problem was that although the clinic had become aware of signs of hacking, A was not informed in time. The clinic first confirmed signs of hacking on the 12th, but A learned that her personal information had been leaked only about two weeks later, through a message from the extortionist.

KBS’s reporting confirmed that the clinic had also reported personal data breaches to the relevant agencies after incidents in May and August.
The clinic said, “The number of victims and the types of information leaked have not been finally confirmed,” adding, “We have notified and are cooperating with the relevant agencies to determine whether personal information was leaked and the extent of the damage.”
Meanwhile, police have received a complaint against the clinic and launched an investigation.
[email protected] An Gaeul Reporter