Personal information of 219,665 users of Gangnam Unni leaked… Hospital names, procedure histories, and consultation photos were exposed
Date
Sep 11, 2026
Classification
- Startup Trends
Unauthorized access to the consultation records API on September 4 exposed the information of 219,665 people. The breach included approximately 160,000 domestic users as well as overseas users in Japan, Taiwan, Thailand, China, and other countries. Beyond names and contact details, the exposed information included hospital names, doctors’ names, treatment histories, consultation photos, and payment information. The 14-year-old platform, which grew to KRW 75.2 billion in revenue and KRW 74.1 billion in cumulative investment in 2025, faced a trust risk just two months after its rebranding.
It was confirmed on September 7 that the personal information of 219,665 users of the aesthetic medical platform Gangnam Unni had been leaked externally.
Beyond names and contact details, hospital names, doctors’ names, and consultation photos were exposed… including 60,000 overseas users
According to operator Healing Paper, an abnormal access attempt was made on the 4th through the API integration feature used to retrieve consultation records. The company blocked the route immediately after detecting unusual activity, but also confirmed that the same attacker attempted to break in again through another route on the following day, the 5th.
The breach affected approximately 160,000 people in Korea, 48,000 in Japan, 4,218 in Taiwan, 1,591 in Thailand, 481 in China, and 5,308 in English-speaking and other countries. The nature of the exposed information is the key issue. In addition to basic information such as names, contact details, dates of birth, gender, residential areas, social login IDs, and access IP addresses, the leaked data included the event and procedure names for which consultations were requested, doctors’ names, hospital names, consultation status, consultation photos, and desired appointment times. Some information about interests, applications, actual procedures, visit dates and times, payment amounts, payment methods, and payment times was also included. The industry is concerned about the potential for privacy violations and financial fraud, as combining facial photos with treatment histories could enable threatening communications or highly targeted phishing beyond simple spam.
Revenue growth from KRW 24.5 billion to KRW 75.2 billion in three years, followed by a challenge just two months after rebranding
Healing Paper is an aesthetic medical O2O platform company founded in 2012. It began as a chronic disease management app, but after failing to find a stable revenue model, shifted toward aesthetic medicine by launching Gangnam Unni in 2015. It raised KRW 300 million in seed funding in 2015 and KRW 4.5 billion in Series A funding in 2019, bringing its cumulative investment to KRW 74.1 billion.
Performance rose sharply. Operating revenue grew from KRW 41.7 billion in 2023 (KRW 24.5 billion the previous year) to KRW 53 billion in 2024 and KRW 75.2 billion in 2025, a year-on-year increase of 41.9%. In August 2020, the company acquired Japan’s aesthetic medical platform 'Lukumo' and established Healing Paper Japan, expanding overseas. In July this year, it unveiled a new logo and brand mission and carried out a full rebranding under the banner of a global 'beauty navigator'. This incident occurred shortly afterward.
The company said it had strengthened authentication procedures, enhanced its abnormal-access detection system, and reorganized its authorization verification logic. It requested an investigation from the local police station on the 6th, reported the breach to the Korea Internet & Security Agency, and individually notified affected users. Users can check the information exposed in their own case on the website for 30 days.
Coupang KRW 624.6 billion · TVING KRW 200 billion… questions left by the '3% of revenue' fine structure
The Gangnam Unni incident cannot be viewed merely as an isolated corporate breach. In November last year, approximately 33.7 million personal information records were leaked from Coupang, while information from 39.54 million TVING accounts, including duplicate accounts, was exposed. Earlier this month, TVING announced a user compensation plan worth more than KRW 200 billion in total.
Debate over the enforcement structure has already begun. Under the current Personal Information Protection Act, the maximum fine is 3% of total revenue. Coupang was fined KRW 624.681 billion, while TVING, with annual revenue in the KRW 400 billion range, would face only about KRW 12.18 billion by a simple calculation. Applying the same standard to Gangnam Unni would put the maximum at around KRW 2 billion. Critics say a structure in which smaller revenue leads to smaller fines is bound to raise questions of fairness. In other words, the company’s size, rather than the sensitivity of the leaked information, determines the severity of the sanction.
TVING’s decision to proactively offer compensation exceeding the anticipated fine is interpreted as reflecting a judgment to prevent factors that could reduce its corporate value during future partnerships, new businesses, fundraising, and M&A processes. For an unlisted growth company, the actual cost of a security incident is calculated not in the fine but in the valuation of the next round.
Gangnam Unni is a platform that grew to KRW 75.2 billion in revenue over 14 years by breaking down information asymmetry in aesthetic medicine. This breach is a case in which the 'data users candidly disclosed' that supported its growth was transformed directly into a risk. Because the exposed information included hospital names, treatment histories, and consultation photos, recovering from the damage will be more difficult than in a typical contact-information breach. The severity of the Personal Information Protection Commission’s sanctions and the company’s subsequent response will remain variables affecting future fundraising and overseas expansion.
#GangnamUnni #HealingPaper #PersonalInformationBreach #AestheticMedicalPlatform #SecurityRisk
[Advertisement]
Collaboration proposals / Business inquiries: hello@startlounge.kr
IR/Pitch deck production inquiries: hello@pitchmound.kr
IR/Pitch deck production inquiries: hello@pitchmound.kr
Everything for startups. Start Lounge - Launchpad 「Lunch Pad」
ⓒ 2026. Start lounge. All rights reserved.
