A large plastic surgery clinic in Seoul's Gangnam district has had patient records stolen, and someone is now using them to extort patients through their partners. The records include nude post-surgery photos and consultation forms showing names and home addresses. KBS broke the story on October 30. Financial News and Maeil Business (MK) have since repeated it. The clinic has not been named publicly. KBS reports that it told a victim it found malware on an internal server and confirmed data had been taken. The clinic also posted an apology on its website. The extortionist asked for cryptocurrency worth 1 million won (about US$700) and threatened to post the material on social media within six days. KBS says this is at least the third breach at the clinic this year. This is a separate incident from the September breach at Gangnam Unni, the cosmetic surgery booking platform.
What Happened
KBS spoke to a woman in her 30s, an office worker, who had breast augmentation at the clinic in September. About a month later, her boyfriend got a message from an unknown sender. It contained photos of her face and bare upper body, plus her consultation form with her name and address. The sender said the material came from data stolen from the clinic. They gave the couple six days to pay 1 million won in cryptocurrency before it went on social media.
She contacted the clinic within 10 minutes. Staff sent her the apology the clinic had posted on its website about 10 days earlier, and told her, "We're victims too." They said they had asked the relevant agencies to investigate and that she should wait.
The reports differ on when the clinic found the breach. Financial News says the clinic confirmed malware and a data leak on the 11th. MK says the clinic first saw signs of hacking on the 12th. Both agree that the patient was not told directly. She found out about two weeks later, when the extortion message arrived. MK also reports that KBS confirmed earlier leaks at the same clinic in May and August.
These may connect to an earlier report. On September 27, Kukmin Ilbo described a "famous" Gangnam plastic surgery clinic whose patient database had been on dark web sites for more than five months. According to Kukmin Ilbo:
- A ransomware group posted a threat on a dark web leak site around April, saying it would publish the clinic's database unless the clinic negotiated.
- The post was later taken down, but the data kept circulating.
- In August, the clinic texted patients that an outside hacking attack had probably exposed some of their data.
- The clinic reported the incident to the Personal Information Protection Commission (PIPC), which is investigating.
Neither Kukmin Ilbo nor KBS has said whether the two reports are about the same clinic. The timelines fit together, but that has not been confirmed.
What Was Taken
No total number of affected patients has been published. Each report describes a different part of the data:
- Extortion case (KBS, via Financial News and MK): face and nude upper-body photos, and consultation forms with names and home addresses.
- Dark web database (Kukmin Ilbo): the clinic itself told patients that names, procedure names, dates of birth, height, weight, addresses and phone numbers were exposed. Kukmin Ilbo says the database also held:
- before-and-after surgery photos
- resident registration numbers (Korea's national ID number)
- blood types
- records of surgery payments
- dated videos tracking patients' recovery
- records that appear to belong to foreign patients
- internal sales and financial data
- a list of VIP patients who had spent more than 10 million won
Kukmin Ilbo estimates at least several dozen patients are affected. - Telegram sale (Dong-A Ilbo): on October 9, a seller on Telegram offered Dong-A reporters records from a South Korean plastic surgery clinic covering surgeries from 2020 to 2026, priced at US$3,000 in Bitcoin. The sample spreadsheet included patient names, phone numbers and treatment histories. Dong-A did not name the clinic. It is not established that this data came from the Gangnam clinic.
How this differs from Gangnam Unni. That breach exposed 219,665 users through a flaw in the platform's interface for looking up consultation records. About 160,000 were in Korea and 48,000 in Japan, according to the operator Healing Paper's reported filings and coverage by Herald Business, News Space and News Tomato. Some users' consultation photos were exposed there too. But that attack hit a booking platform, not a clinic's internal server, and nothing reported so far links the two.
Why It Matters
Patients' partners are the target. Sending the photos to a boyfriend instead of the patient adds shame and social pressure, and gives the extortionist a second person to push. The ransom is small enough that a victim might pay quickly. That points to criminals planning to repeat the scheme across many patients rather than one large ransom from the clinic.
Stolen data stays dangerous for months. If the Kukmin Ilbo account is about the same clinic, the database had been circulating since around April. The extortion happened in October. Patients Kukmin Ilbo interviewed said they fear deepfakes and voice phishing, and felt they could do nothing until a second crime actually happened.
Patients were not told in time. The patient KBS interviewed learned of the breach from the extortionist, roughly two weeks after the clinic found it. A website notice is not enough when the stolen data includes nude images that can be used for blackmail.
Investigations will take a long time. News Tomato reports that 432 organisations reported breaches to the PIPC in the first half of 2026, close to the 447 reported in all of 2025. The PIPC had 31 investigators against 37 approved positions as of August. Its average time from opening an investigation to a decision was 369 days in the first half of 2026. Affected patients should not expect a regulatory outcome soon.
Medical data is being sold openly. Dong-A Ilbo found 25 posts on five data-trading sites in 2026 offering data said to be stolen from South Korean companies, including plastic surgery patient records.
The Attack Technique
Few technical details have been published. According to KBS, the clinic says malware was planted on an internal server and patient data was taken from it. Kukmin Ilbo's account of a ransomware group threatening to publish the database on a leak site suggests a double-extortion attack: data stolen first, then a threat to publish it if the victim does not pay. Kukmin Ilbo did not name the group, and nobody has publicly claimed the incident.
Several things are still unknown:
- how the attackers first got in
- whether the May, August and October incidents were one ongoing compromise or separate intrusions
- whether the extortionist messaging patients is the original attacker or someone who bought the data later
The clinic told Kukmin Ilbo it is following legal procedures and a separate government-directed investigation, and is still checking whether the leaked data is genuine.
What Organizations Should Do
- Keep clinical photos away from everyday systems. Store surgery and body images in a separate, encrypted system with access logging. Do not keep them on the same servers that handle front-desk, marketing or billing work. Delete images once the medical need for them ends.
- Treat one breach as a sign of more. After an intrusion, assume the attacker is still in the network until a full investigation proves otherwise. Rotate credentials, rebuild affected servers, and look for persistence such as backdoors or scheduled tasks. Three incidents in one year suggests the earlier ones were never fully cleaned up.
- Contact patients directly and quickly. When stolen data could be used for sexual blackmail, call or message each affected patient. Explain what was taken, warn them about extortion, and tell them not to pay. Give them contacts for the police and Korea's digital sex crime victim support services.
- Watch where stolen data is traded. Monitor dark web leak sites and Telegram markets for your organisation's name and data. When a ransomware group posts a threat, treat it as confirmation that data was taken, even if the post is later removed.
- Watch outbound traffic and collect less ID data. Alert on large or unusual outbound transfers from systems holding patient records. Do not keep national ID numbers, blood types and payment records in the same tables as photos unless there is a clear clinical reason.
- Practise a breach-and-extortion response. Run exercises on a scenario where patients or their families receive blackmail messages. Decide in advance who leads, what the clinic will say, and how it will work with police, the PIPC and KISA (the Korea Internet & Security Agency).
Sources: “If you don’t send money, I’ll release your girlfriend’s breast sur... | A large plastic surgery clinic in Gangnam, Seoul, leaked body photo... | Stolen Korean patient records traded openly online The DONG-A ILBO | 이슈포커스 ‘강남언니’ 개인정보 유출 파장 확산…국감·법적분쟁에 IPO 촉각 < 기획특집 < PUBLICVIEW < 기사... | 'My pre-surgery photos were leaked — and all I got was 50,000 point... | 성형 수술 전·후 아내 사진이 다크웹에 올라왔다 - 국민일보 | “Procedure records and consultation photos leaked, yet only 50,000... | (단독)개보위, 유출 신고 몰리는데 조사관은 정원 미달…강남언니 조사도 1년 걸릴까