Korean Plastic Surgery Clinic Hacked, Blackmailed with Nude Photos

Seoul Plastic Surgery Clinic Hit by Hack, Patient’s Boyfriend Receives Ransom Demand

A major plastic surgery clinic in Seoul’s affluent Gangnam district has been compromised by hackers, leading to a distressing situation where a patient’s boyfriend received a ransom message containing her private photos and demanding cryptocurrency. South Korea’s recently enacted legislation mandates notification within 72 hours of suspected data breaches, and it remains unclear if the clinic violated these new regulations.

Patient Targeted After Clinic Breach

The incident involved a female patient in her 30s who underwent surgery at the clinic in September. A month later, her boyfriend received a message from an unknown sender containing explicit photos of her face and upper body, along with a consultation form detailing her name and address. The perpetrator claimed these were part of personal data leaked from the hospital and threatened to release them on social media within six days unless a ransom of approximately 1 million Korean won (about $750 USD or 24,000 New Taiwan Dollars) in cryptocurrency was paid.

The case was exclusively reported by South Korean public broadcaster KBS on October 30.

The patient, identified by KBS as “Ms. A,” a working professional, stated she experienced immediate fear and cold sweats upon receiving the message, worrying that her information might have already reached people she knew. She contacted the clinic within 10 minutes. The clinic informed her that its internal servers were infected with malware on October 11, confirming signs of a data leak. They also provided an apology statement, which had been posted on their website for about 10 days.

Ms. A recounted the clinic’s response, which included stating, “Aren’t we also victims?” and assuring her that relevant authorities were investigating and requested patience. The clinic’s official statement maintained that the “scale of the damage and the leaked content have not been finally confirmed” and that they were cooperating with authorities after reporting the incident.

New Data Protection Law in Effect

A revised amendment to South Korea’s Personal Information Protection Act came into effect on September 11, just one month prior to this incident. Previously, companies were only required to notify individuals if they confirmed an actual data breach. The new law introduces a “breach possibility notification” requirement: in cases of illegal access or suspected breaches where victims are difficult to identify, notification must be sent within 72 hours of discovery, even without final confirmation.

Notifications are generally to be made through individual channels such as written notices, emails, or text messages. Website announcements are only permissible as a substitute for direct notification if there are “justifiable reasons, such as not knowing the individual’s contact information,” and must remain online for at least 30 days. Failure to notify within the deadline or to take measures to prevent further damage can result in fines increased by up to 30%.

In June, South Korea’s Personal Information Protection Commission imposed a record fine of 624.7 billion Korean won on e-commerce platform Coupang. However, that penalty was tied to revenue and would not be applicable to a clinic.

It is currently up to regulatory authorities to determine if the plastic surgery clinic violated any regulations, and no conclusion has been reached.

Precedents of Data Extortion

While institutions may refuse to pay, patients are left vulnerable with their privacy at stake. Both international and domestic cases exist where hackers, after stealing patient data, directly extort individuals with demands at a personally affordable level.

In 2017, Lithuanian plastic surgery chain Grožio Chirurgija was targeted by the hacker group Tsar Team, who stole over 25,000 private photos and personal data. After the clinic refused their demand for 300 Bitcoin, the hackers turned to patients, seeking up to 2,000 Euros per person.

In 2018, an unnamed South Korean plastic surgery clinic’s website was hacked, and patients received ransom letters claiming possession of photos and demanding 0.02 Bitcoin. Hong Min-pyo, CEO of cybersecurity firm SEWORKS, advised against responding, warning that paying would invite further extortion.

In 2020, hackers from Finnish psychotherapy provider Vastaamo obtained data from approximately 33,000 clients. After the institution refused a demand for 40 Bitcoin, the hackers targeted patients, demanding between 200 and 500 Euros each. A court later recognized over 20,000 attempted extortion cases and 20 completed ones.

The effectiveness of paying such ransoms is questionable. Cybersecurity company Malwarebytes noted that in one instance, the hacker ultimately released the data anyway. This incident serves as a stark reminder that in the age of AI, cybersecurity requires increased attention, as passwords can be reset, but leaked private photos are irretrievable.