Loading story…
Healing Paper disclosed that unauthorized, abnormal access to an API used by its Gangnam Unni beauty-medical platform exposed personal data belonging to 219,665 domestic and international users. The company detected access to a consultation-record retrieval API, blocked the identified route, and said the same attacker attempted to use another route the following day; no responsible threat actor has been identified.
The affected users include roughly 160,000 people in South Korea, 48,000 in Japan, and 4,218 in Taiwan. Potentially exposed information includes account and device details alongside highly sensitive consultation, treatment, payment, visit, procedure, and patient-photo data, creating material privacy, fraud, and extortion risk for affected individuals.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Healing Paper disclosed a personal-data breach affecting 219,665 Gangnam Unni users, including users in South Korea, Japan, and Taiwan. Exposed information reportedly included account and device data as well as consultation, treatment, payment, visit, procedure, and patient-photo information.
Healing Paper reported that the same attacker attempted to access its systems through a different route after the original API route was blocked.
Healing Paper identified abnormal access to Gangnam Unni's API integration feature used to view consultation records. The company blocked the access route after detection; the incident ultimately affected about 220,000 users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coupang, South Korea's largest e-commerce platform, confirmed a major data breach that exposed the personal information of approximately 33.7 million customers, representing a significant portion of the country's population. The breach, which was initially detected on November 18 with only 4,500 accounts affected, was later found to be far more extensive, involving names, email addresses, phone numbers, shipping addresses, and partial order histories. Coupang stated that payment card details and login credentials were not compromised. The unauthorized access reportedly began on June 24, originating from overseas servers, and was facilitated by weaknesses in Coupang's authentication key management, including the failure to rotate or revoke signing keys after responsible employees left the company. South Korean authorities, including the National Police Agency, Korea Internet & Security Agency, and the Personal Information Protection Commission, have launched investigations into the incident, focusing on Coupang's compliance with data protection obligations. The government convened an emergency meeting and announced plans for stricter oversight and potential sanctions if safety measure violations are confirmed. Coupang has since blocked the unauthorized access route, enhanced internal monitoring, and engaged external security experts. The company issued public apologies and is cooperating with authorities to prevent further harm, while also notifying affected customers and providing support channels for inquiries.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Practice by Numbers remediated an access-control flaw in its dental patient portal after a patient discovered that changing sequential document numbers in the URL let any authenticated user view other patients’ files. The exposed records included private health information, medical histories, personal details, and photo identification. After difficulties reporting the issue through the company’s broken or missing security contact channels, TechCrunch alerted the vendor, which took the portal offline, fixed the bug, and restored service. Practice by Numbers said server logs indicate fewer than 10 patients were affected, that it found no evidence of earlier exploitation, and that it is notifying the impacted dental practice. In a separate privacy exposure, researcher Jeremiah Fowler found a publicly accessible, passwordless database containing 86,859 private images, screenshots, and messages linked to a high-profile European celebrity and several social media influencers. The leaked material included chats from WhatsApp, Facebook, TikTok, and Instagram, along with phone numbers, email addresses, invoices, receipts, and identity-related documents. Fowler said the screenshots appeared to have been captured from victims’ phones, pointing to suspected stalkerware activity before the data was exposed through a misconfigured server, and he notified affected individuals and law enforcement while withholding names to limit further harm.
Jun 29, 2026