Personal information of 219,665 users of Gangnam Unni leaked… hospital names, treatment histories, and consultation photos were also exposed
Date
Sep 11, 2026
Classification
- Startups
#
- Startup Trends
Author
Unauthorized access to the consultation records API on September 4 led to the personal information of 219,665 people being leaked. The affected users included approximately 160,000 people in Korea as well as users overseas in Japan, Taiwan, Thailand, China, and other countries. Beyond names and contact information, the leaked items included hospital names, doctors’ names, treatment histories, photos uploaded for consultations, and payment information. The 14-year-old platform, which grew to KRW 75.2 billion in revenue in 2025 and KRW 74.1 billion in cumulative investment, now faces a trust risk just two months after its rebranding.
It was confirmed on September 7 that the personal information of 219,665 users of the aesthetic medical platform Gangnam Unni had been leaked externally.
Beyond names and contact information, hospital names, doctors’ names, and consultation photos were also leaked…including 60,000 users overseas
According to operator Healing Paper, an unauthorized access attempt was made on the 4th through the API integration feature used to retrieve consultation records. The company blocked the route immediately after detecting unusual activity, but also confirmed that the same attacker attempted to break in again through another route on the following day, the 5th.
The leaked data covered approximately 160,000 people in Korea, 48,000 in Japan, 4,218 in Taiwan, 1,591 in Thailand, 481 in China, and 5,308 in English-speaking and other countries. The concern lies in the nature of the information. In addition to basic data such as names, contact information, dates of birth, gender, residential areas, social login IDs, and access IP addresses, the leak included the event and treatment name for which a consultation was requested, doctors’ names, hospital names, consultation status, photos uploaded for consultations, and preferred appointment times. Some information about users’ interests, consultation requests, and actual treatments, as well as visit dates and times and payment amounts, methods, and times, was also included. The industry is concerned about privacy violations and the possibility of financial fraud, as combining facial photos with treatment histories could lead beyond simple spam to threatening messages or highly targeted phishing.
Revenue grew from KRW 24.5 billion to KRW 75.2 billion in three years, then a setback arrived just two months after the rebranding
Healing Paper is an aesthetic medical O2O platform company founded in 2012. It began as a chronic disease management app, but failed to find a stable revenue model and shifted toward aesthetic medicine by launching Gangnam Unni in 2015. It raised KRW 300 million in seed funding in 2015 and KRW 4.5 billion in Series A funding in 2019, bringing its cumulative investment to KRW 74.1 billion.
Performance rose sharply. Operating revenue grew from KRW 41.7 billion in 2023 (KRW 24.5 billion the previous year) to KRW 53 billion in 2024 and KRW 75.2 billion in 2025, up 41.9% year on year. In August 2020, the company acquired Japan’s aesthetic medical platform 'Lukumo' and expanded overseas by establishing Healing Paper Japan. In July this year, it unveiled a new logo and brand mission and carried out a full rebranding, positioning itself as a global 'beauty navigator.' The incident occurred immediately afterward.
The company said it had strengthened authentication procedures, upgraded its system for detecting unusual access, and overhauled its authorization verification logic. It requested an investigation from the police station with jurisdiction on the 6th, reported the leak to the Korea Internet & Security Agency, and individually notified affected users. It also allowed users to check the items leaked from their accounts on the website for 30 days.
Coupang KRW 624.6 billion, TVING KRW 200 billion…questions left by the '3% of revenue' fine structure
The Gangnam Unni incident is difficult to view as an isolated corporate breach. In November last year, approximately 33.7 million records of personal information were leaked from Coupang, while information from 39.54 million TVING accounts, including duplicates, was exposed. Earlier this month, TVING announced a user compensation plan worth more than KRW 200 billion in total.
Debate over the enforcement structure has already begun. Under the current Personal Information Protection Act, the maximum fine is 3% of total revenue. Coupang was fined KRW 624.681 billion, while TVING, with annual revenue in the KRW 400 billion range, would face only about KRW 12.18 billion by a simple calculation. Applying the same standard to Gangnam Unni would put the ceiling in the KRW 2 billion range. Critics say a structure in which smaller revenue leads to smaller fines is bound to spark concerns about fairness, because a company’s size, rather than the sensitivity of the leaked information, determines the severity of the sanction.
TVING’s decision to proactively offer compensation exceeding the expected fine is interpreted as reflecting a judgment that it should prevent factors that could reduce its corporate value in future partnerships, new businesses, fundraising, and M&A processes. For an unlisted growth company, the true cost of a security incident is calculated not in the fine but in the valuation of its next funding round.
Gangnam Unni is a platform that grew to KRW 75.2 billion in revenue over 14 years by addressing information asymmetry in aesthetic medicine. This leak is a case in which the 'data users candidly disclosed' that served as the foundation of that growth was transformed directly into a risk. Because the leaked items included hospital names, treatment histories, and consultation photos, recovering from the damage will be more difficult than in a typical contact information leak. The level of sanction imposed by the Personal Information Protection Commission and the company’s subsequent response will remain variables affecting future fundraising and overseas expansion.
#GangnamUnni #HealingPaper #PersonalInformationLeak #AestheticMedicalPlatform #SecurityRisk
[Advertisement]
Collaboration proposals / Business inquiries: hello@startlounge.kr
IR/Pitch deck production inquiries: hello@pitchmound.kr
IR/Pitch deck production inquiries: hello@pitchmound.kr
Everything about startups. Start Lounge - Launch Pad 「Lunch Pad」
ⓒ 2026. Start lounge. All rights reserved.
