SecurityHeroblog
Security Basics19views

The Grown-Up Who Says 'Your Mom Sent Me' — The Phone Call That Will Follow the Gangnam Unni Breach

It has been reported that the information of some 219,000 users of Gangnam Unni, a cosmetic-medicine app, was leaked. Not just names and phone numbers, but which clinic they consulted, which procedure they discussed, and even consultation photos. Here is what to do when someone holding that information calls and pretends to be the clinic.

There is a rule we learned in elementary school. If a stranger at the school gate says, “Something urgent came up for your mom, and she asked me to pick you up,” you don’t go with them. Instead, you call your mom directly.

What if that grown-up knows your name? What if they know which class you’re in, even that you went to piano lessons yesterday?

The rule does not change. If anything, you hold to it harder. Knowing a lot about me and being someone my mom sent are two different things. There is only one way to check: call the number I know for my mom, and I make the call myself.

The incident reported this week makes grown-ups pull that rule back out. This post stays at the school gate all the way through.

First, What Could Happen on My End

A call comes in from an unfamiliar number. The person says: Hello, we’re calling about a free follow-up consultation for the ○○ procedure you received last month at ○○ Clinic.

The clinic name is right. The procedure name is right. The month you went is right. Then they ask you to tap the link they’ve sent by text to confirm. Or they say they need your card details to apply a return-visit discount.

It is hard to be suspicious here. The only people who know you went to that clinic are you and the clinic. But that premise has now broken.

FACT Healing Paper, the operator of Gangnam Unni — an app for finding, consulting with, and booking dermatology and cosmetic surgery clinics — disclosed on September 7 that the personal information of 219,665 users had been leaked. Four outlets, including the Kyunghyang Shinmun, reported this the same day.

FACT It was reported that, in announcing the breach, the company urged users to watch out for contacts impersonating Gangnam Unni or clinics — offering clinic guidance or discounts, or pushing users to tap links. Impersonation means borrowing someone else’s name and pretending to be them. Commentators also noted that because procedure and consultation information was mixed in, there is concern about secondary harm from people impersonating clinics or the app. Secondary harm refers to things like fraud that happen using the information after the leak itself (the primary harm).

INFERRED One thing needs to be made clear. The call described above is a call that “could come.” There are no reports yet that such calls have actually been made and caused harm. Right now we are at the stage where the company has said “be careful.” But the material for building impersonation contacts has leaked — that much is reported fact — and that is why this post exists.

Back at the school gate, it looks like this. The stranger doesn’t just know your name. They know your class and the lesson you went to yesterday. Even so, there is still not a single piece of evidence that this person was sent by your mom.

Why It Works — They’re Holding ‘What Only I and the Clinic Know’

Leaks of names and phone numbers have happened often. What makes this one different is what leaked.

FACT For basic information, it was reported that names, phone numbers, email addresses, dates of birth, gender, country and region of residence, social-login IDs, access IPs (the address attached to a device when it connects to the internet), and device information (what phone you use) were leaked.

FACT Up to here, it resembles other breaches. The problem is what comes next. Among items tied to consultation requests, event/procedure names, clinic names, doctor names, and consultation photos were leaked, as reported by Edaily.

FACT According to Asia Economy’s reporting, some data was also leaked on which procedure a user was interested in, applied for, and actually received; the date of the clinic visit and the date of the procedure; and the amount paid, the payment method, and the time of payment.

INFERRED The way we usually screen out impersonation calls comes down to one thing: seeing how much the other side knows about us. If they only give a name, we get suspicious; if they name our clinic, our procedure, the date, and the amount we paid, we believe them. But that is exactly the list that leaked this time. So the judgment “they know this much detail, so it must be the clinic” does not work in this case. Knowing the details is not proof it’s the clinic — it may be a sign that they’re holding the leaked information.

FACT The route of the leak was reported as follows. On September 4, there was abnormal access to an integration feature (an API) used to look up consultation records. An API is the channel through which an app and a server exchange data. On September 5, the company says it detected the same attacker attempting to get back in through a different route and blocked it. The company requested a police investigation on September 6. Requesting an investigation means formally asking the police to “look into this.”

INFERRED Why that channel was open, and how it was breached, have not been made public. This post does not speculate on the method. What readers need to know is not the method, but what got out and therefore what to be careful of.

The Size, in Numbers

Let’s lay the numbers out in a table. Please read the third column too. All of these are reports relaying the company’s announcement; we have not directly verified the company’s original notice.

Number What Source
219,665 people Everyone affected by the leak Kyunghyang Shinmun (reported)
About 160,000 Of those, Korean users Kyunghyang Shinmun (reported)
About 48,000 · 4,218 · 1,591 · 481 · 5,308 Japan · Taiwan · Thailand · China · Other Kyunghyang Shinmun (reported)
30 days Period during which you can check your leaked items on the website Asia Economy (reported)
September 4 · 5 Day of abnormal access · day of the repeat attempt Newspim (reported)

FACT 219,000 is a number that’s hard to grasp. Even calling a thousand people a day, it would take more than seven months to get through. And seven out of ten are Korean users. If you have ever consulted or booked through this app in Korea, it’s reasonable to assume you’re in there too.

FACT That said, this number is the count of people whose information leaked, not the count of people who were defrauded. They are different values. It means 219,000 students could have a stranger standing at their school gate — not that 219,000 students followed one.

FACT Look at the dates too. The abnormal access was September 4; the company’s announcement was September 7. Three days later. Today is September 12, so it has been eight days since the information got out.

INFERRED If impersonation contacts come, they could start right after the information got out. So it’s not “I should be careful someday” — it’s from now. The same goes for the 30-day lookup window. The reports don’t say when the period starts counting, but if it’s from the announcement date, the remaining days are already shrinking. Put it off, and the window closes.

So, What to Do Now

Two things. Both can be done today.

One. Within 30 days, check for yourself which of your information got out.

It was reported that Gangnam Unni has opened a page on its website where you can look up your own leaked items. The company also says it sent individual notices — that is, a separate notification to each affected person. If you received a notice, act on the assumption that you’re affected. Check, and if clinic names or procedure information are included, put every contact that comes in citing that clinic’s name on your suspect list from now on. It’s the same as knowing in advance that the stranger knows your class number. If you know, you won’t be caught off guard.

Two. If a call comes in first under the name of a clinic or Gangnam Unni, do not answer on the spot.

Hang up. Then you make the call yourself — to the clinic’s main number that you already know, or through the official channel inside the app. Ask whether they really contacted you. A real clinic has no reason to mind this check.

In particular, treat these requests as impersonation the moment they come up: tap this link; install this app; give us your card or account details; read us the verification code. A verification code is a one-time number a bank or app sends by text; it’s for confirming your identity, so the moment you read it to someone else, it’s the same as handing over your account. There is no case where a clinic’s follow-up care notice needs any of these four.

INFERRED It’s the school-gate rule, exactly. How well the other side knows you is not the criterion. Who approached first is the criterion. You don’t follow the one who approached first. You call the number you know, yourself. This rule works the same for an elementary schooler and for a grown-up whose consultation records have leaked.

What We Don’t Know

This blog does not write unconfirmed things as if they were confirmed. Here is what is still unknown in this case.

  • We don’t know who did it or why. The perpetrator and the motive have not been reported. Nor has it been reported whether the leaked information was actually sold or spread. That is why this post names no nationality and no group.
  • We don’t know whether actual impersonation harm has occurred. Right now we are at the stage of “concern” and the company’s caution. The phone-call scene in this post is something that “could happen,” not something that “has already happened.”
  • We don’t know how many people’s consultation photos were involved, or whether the photos show identifiable faces. The reports don’t say.
  • We don’t know how abnormal access to the API was possible. Whether authentication was weak or an account was hijacked has not been disclosed.
  • We don’t know whether a report was filed with the Personal Information Protection Commission, or whether an investigation has begun. None of the articles we checked mention it.
  • We have not seen the company’s official notice firsthand. We could not find the text on Gangnam Unni’s public website; it appears to have been provided inside the app or through individual notices. Every detail in this post is based on reporting.

Unconfirmed: the company’s original notice, whether a report was filed with the Personal Information Protection Commission, whether actual impersonation harm has occurred, and the perpetrator and cause. The figures and leaked items in this post were cross-checked across reports from four outlets; the headcount, distribution by country, items, dates, 30-day lookup, and investigation request all matched.

Sources

The primary source is the breach notice Healing Paper (Gangnam Unni) sent to its users. We could not verify the original on a public page, so the reports below stand in for it.

This post is built from others’ reporting, not our own observation. That is why there are no attack timeline, MITRE, or IOC blocks — we do not fabricate material that doesn’t exist. Every fact is based on reports relaying the company’s September 7, 2026 announcement; since we could not directly verify the company’s original notice, the body marks these with “it was reported.” The 219,665 affected is the number of people whose information leaked, not the number of victims. The perpetrator, cause, and nationality are unconfirmed and therefore not stated. No reproducible commands, addresses, or procedures are included. Observed and published 2026-09-12.