South Korean Medical Beauty Platform Gangnam Unni Suffers API Breach Exposing 220,000 Users' Sensitive Photos and Medical Records
Healing Paper, the operator of South Korea's largest medical beauty platform Gangnam Unni, issued a public apology on September 7 confirming that personal data of nearly 220,000 customers had been exposed through abnormal access to an API interface.
What Data Was Leaked
The breach involved far more than basic identifiers. Exposed information included names, phone numbers, email addresses, birth dates, gender, residential locations, social media IDs, and IP addresses. More critically, it also revealed medical beauty consultation details such as requested procedures, hospital and doctor names, reasons for consultation, treatment progress, user-uploaded consultation photos, appointment times, completed procedures, visit records, and payment information. These records create a comprehensive profile of an individual's health status, appearance insecurities, spending patterns, and movement history, including highly private pre-procedure images that users would never want shared.
Of the affected users, roughly 160,000 were in South Korea and 60,000 overseas. The overseas group included 48,000 from Japan, 4,218 from Taiwan, 1,591 from Thailand, and 481 from mainland China.
How the API Became the Leak Point
The attack path was straightforward and did not require sophisticated techniques. On September 4, attackers abnormally accessed an API endpoint designed for querying consultation records. After Healing Paper blocked that path, the same actor attempted access via a different route the next day. The root cause was insufficient authentication checks and missing rate-limiting controls on backend APIs. Many platforms focus security efforts on the main website and user interface while leaving API endpoints with loose access controls, incomplete logging, and no real-time anomaly detection.
Secondary Risks After the Breach
Security experts in South Korea have warned of immediate follow-on threats. Attackers could use the detailed medical and appointment data to craft convincing phishing messages impersonating the platform or clinics, offering fake promotions or appointment reminders. Even more concerning is the potential for extortion, where victims are threatened with the release of their pre-procedure photos and treatment records unless they pay.
Remediation and Recommendations
Healing Paper has reported the incident to the Korea Internet & Security Agency, involved law enforcement, conducted a full system review, strengthened identity verification, and added abnormal access monitoring. Users can check their exposure status on the official site within 30 days of the announcement.
Security teams are advised to treat APIs with the same rigor as primary web applications: enforce strict authentication and least-privilege access, implement rate limiting and behavioral analytics on sensitive endpoints, integrate API logs into SIEM systems, and include API attack surfaces in regular penetration testing. Users who registered with Gangnam Unni or similar platforms should verify any unexpected messages claiming to be from the service or clinics through official channels before clicking links or providing information.
Related articles
Dropbox Accounts Compromised Through Lenovo ID Authentication Flaw
Several thousand Dropbox accounts were breached between August 4 and 21 due to an authorization flaw involving Lenovo ID. The root cause was an error on Lenovo's side that permitted registration of accounts using arbitrary email addresses, which could then be used to access matching Dropbox accounts. Dropbox responded by forcing logouts for all users who had relied on Lenovo ID and by requiring direct password entry for Dropbox credentials. Approximately 5,000 accounts were affected, though only about one-third saw stored files accessed by attackers. Accounts protected by two-factor authentication remained unaffected. Additional reports from the same period covered Kaspersky analysis of ValleyRAT spyware using DLL sideloading, a critical SQL injection vulnerability in the All-in-One WP Migration WordPress plugin, and a Google Chrome update addressing CVE-2026-85046 in the V8 engine.
Detecting and Removing Secrets from Git History with Betterleaks and git-filter-repo
Developers often accidentally commit sensitive data such as API keys, passwords, database dumps, or private uploads to Git repositories. Even after removal in a later commit, these secrets remain accessible in the commit history and can be recovered by anyone with repository access. The recommended approach begins with scanning the entire history using specialized tools to identify leaked credentials across all branches and past commits. Once identified, the secrets must first be rotated or revoked before any history rewriting occurs. Tools like Betterleaks provide detection with keyword filtering, entropy analysis, and Base64 decoding, while git-filter-repo enables precise removal of files and replacement of secret strings throughout the repository timeline. The process requires careful backups, coordination with teams, and force-pushing rewritten history, followed by fresh clones for all contributors and CI/CD systems. Even after cleanup, organizations must assume that old secrets may persist in forks, backups, or caches and therefore treat rotation as mandatory.
Dropbox Lenovo ID Integration Flaw Exposes Thousands of Accounts Without Passwords
A flaw in the federated authentication process between Dropbox and Lenovo ID allowed attackers to compromise approximately 5,000 accounts between August 4 and August 21, 2026. Attackers registered a Lenovo ID using the email address tied to an existing Dropbox account due to missing email verification checks. They then logged in via the Lenovo ID option, and Dropbox automatically associated the identity with the existing account without requiring the original Dropbox password. Only accounts linked to the Lenovo ID integration and lacking two-factor authentication were affected. In fewer than one-third of the compromised accounts, attackers viewed or downloaded stored files. Dropbox responded by terminating all Lenovo ID sessions, removing existing associations, and updating the login flow to require the Dropbox password. Lenovo described the issue as stemming from a legacy integration and stated that its own customers were not directly impacted.
Yellow Hat Reports Breach in Web Work Reservation System, Possible Leak of 1.8 Million Member Records
Japanese automotive retailer Yellow Hat disclosed that its Web Work Reservation System was compromised, potentially exposing personal data of up to 1,801,499 members. The intrusion was detected on August 18, 2026, after which investigators confirmed that customer information stored on the company's member server may have been exfiltrated. Affected records include names, telephone numbers, email addresses, and member numbers. Yellow Hat has notified law enforcement and Japan's Personal Information Protection Commission while contacting impacted individuals through multiple channels. The company is advising members to remain vigilant against unsolicited communications that could indicate misuse of the stolen data.