Police are investigating a data leak at a major plastic surgery clinic in Seoul’s Gangnam district after intimate patient photographs and personal information were allegedly used in an extortion attempt. The exposed material reportedly included photographs showing a patient’s face and upper body, as well as details such as her name, address and resident registration number.
A woman in her 30s learned of the leak after a message was sent to her boyfriend about a month after she underwent breast surgery in September. The sender displayed her photographs and a consultation document, threatened to publish the material on social media six days later, and demanded cryptocurrency worth about 1 million won to prevent its release.
- Demand
- Cryptocurrency worth about 1 million won
- Threat
- Publication of the patient’s photographs on social media
- Police transfer
- Sent to the Seoul Metropolitan Police cyber investigation unit on October 30
The clinic sent the patient an apology stating that it had found signs of malware inserted into an internal server and that information had been extracted. Reports said the clinic had detected indications of an intrusion before the threat was received, while the patient said she learned that her own information had been exposed only after the extortion message arrived roughly two weeks later. The available evidence does not establish who inserted the malware or whether the person making the demand was responsible for the intrusion.
Police examine the breach and earlier leaks
The Seoul Dobong Police Station received the woman’s petition concerning the alleged threat on October 25. A separate complaint seeking punishment of the clinic for an alleged violation of personal information protection law was filed on October 29. Police transferred the case to the Seoul Metropolitan Police Agency’s cyber investigation unit on October 30 after considering its nature and potential scope.
The clinic reportedly experienced other personal data leaks in May and August of the same year and notified the relevant authorities. It said the final number of affected patients and the precise categories of exposed information had not yet been confirmed. Investigators and regulators must now determine the extent of the breach, how the records left the clinic’s systems and whether the leaked data was used in additional threats.