ENKR

Younghoon Medical Foundation (Sun hospitals) website member data breach (2024)

Add to my breach check

188,481 people

What leaked6

Replaceable

  • Plain-text password
  • Password

Hard to replace

  • Mobile number
  • Username

Permanent

  • Date of birth
  • Full name
  • Plain-text passwordsome passwords could be decrypted
  • Passwordstored with an unsafe algorithm and no salt

To-dos4 · about 1 h in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  3. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover
  4. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: phishing messages

What happened next3 events

  1. UndetectedNone on record
  2. ResponseNo individual notice on record
  3. RemedyNone on record
  4. Penalty 3 eventsFine ₩630M · show events
  5. DisputesNone on record
  1. Ordered to check its personal data systems for flaws regularly and fix them
  2. Penalty surcharge of KRW 630 million
  3. PIPC found the hospital website collected member data out of habit, ran no web firewall, never checked for SQL injection or validated input, and stored passwords with an unsafe algorithm and no salt; 188,481 people affected
Company
Younghoon Medical Foundation
When it happened
Notice
Leak confirmed
Affected
188,481 people · hospital website members; PIPC

How the facts developed

  1. PIPC found that an attacker used an SQL injection flaw on the hospital website in March 2024 and took data of 188,481 website members

Sources