The beauty medical platform Gangnam Unni has experienced a data breach affecting approximately 220,000 personal records, prompting a major law firm in South Korea to initiate a class action lawsuit. Attention is now focused on the court's ruling regarding the leak of consultation and treatment information.
On September 10, legal sources reported that law firm YK has filed a damages lawsuit against Healing Paper, the operator of Gangnam Unni, and is recruiting affected members to join the plaintiff group.
Previously, Healing Paper announced on September 7 that it had detected abnormal access to its consultation history inquiry feature (API) on September 4, resulting in the leak of some customers' personal information. After identifying the unusual activity, the company blocked the access route, but confirmed the next day that the same attacker attempted to access the system again through a different route.
The breach affected a total of 219,665 individuals, with around 160,000 being domestic users. Additionally, approximately 48,000 users from Japan and many others from Taiwan, Thailand, China, and English-speaking countries were also impacted.
The leaked information includes names, phone numbers, email addresses, birth dates, genders, countries and regions of residence, social network login IDs, IP addresses, and device information. Notably, details related to consultation requests, including treatment names, hospital names, doctor names, desired appointment times, reasons for consultation, and progress status, were also compromised. In some cases, information about the treatments individuals expressed interest in, actual treatment details, appointment dates, names of treating doctors, and payment amounts and methods were included.
This incident is particularly concerning as it involves not only general personal information like names and contact details but also sensitive data regarding the consultations and treatments users sought. The nature of the leaked information and the resulting emotional distress are expected to be key issues in determining the damages awarded.
YK views this incident as distinct from a typical data breach. According to Article 23 of the Personal Information Protection Act, health-related information is classified as sensitive. The leaked details about consultation treatment names, hospitals, doctors, and actual treatment histories could reveal which medical institutions individuals consulted or received treatment from.
YK believes that this information is likely to be classified as sensitive under the Personal Information Protection Act. If recognized as such, additional consent would be required at the collection stage, and appropriate safety measures must be implemented during processing, which will be crucial in determining liability.
The scale of damages is also expected to be a significant point of contention in the lawsuit. In data breach cases, the type and nature of the leaked information, the extent of the breach, and the degree of harm suffered can all influence the calculation of damages. YK argues that the leak of specific beauty medical consultation and treatment histories, which individuals may be reluctant to disclose, warrants a different assessment of emotional distress.
Attorney Hyun Min-seok of YK stated, "Even though cosmetic procedures have become commonplace, individuals still prefer to keep their consultation and treatment histories private. The emotional distress experienced by victims may differ significantly between cases where only names and contact information are leaked and those where detailed treatment histories are also exposed."
Future litigation will likely examine whether Healing Paper implemented appropriate access controls and safety measures in processing personal information, including the consultation history inquiry API. YK plans to investigate whether the inquiry feature was adequately controlled to respond only to authorized users during the lawsuit.
Attorney Hyun added, "This incident goes beyond a simple member information leak, as it involves the exposure of users' consultation and actual treatment information. We will work to substantiate the sensitivity of the leaked information and the emotional harm suffered by victims to ensure adequate compensation is achieved."
YK has previously handled numerous class action lawsuits, including cases involving Pizza Hut franchise owners, and is currently representing victims in a data breach case involving the marriage information company Duo. Victims of the Gangnam Unni data breach can apply to participate in the lawsuit through the official website of law firm YK.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.