Wonjin Plastic Surgery Listed by Black X Ransomware Group

On April 7, 2026, South Korean plastic surgery clinic WJ Wonjin was listed on the leak site of the Black X ransomware group after the attackers exfiltrated internal files during a ransomware incident. Patients who have visited the clinic, along with current and former staff, now face the risk that sensitive personal and medical information tied to their names could be publicly released.

What's Publicly Reported from Reporting

Public reporting indicates that internal files were taken in the attack. The Black X group published a listing for WJ Wonjin on its dark-web leak site, giving the clinic a deadline to negotiate before data is released. No exact victim count has been disclosed, and the precise contents of the stolen files remain unconfirmed by the clinic. Available reporting describes the incident as a classic ransomware double-extortion case in which data is both encrypted and exfiltrated for leverage.

Why This Matters for You and Your Family

Medical and cosmetic procedure records often contain full names, addresses, phone numbers, dates of birth, passport copies, payment details, and clinical photographs. If these records reach the open internet, they can be used for identity theft, insurance fraud, blackmail, or targeted scams. Families are affected because one person’s visit can expose shared contact information, spouse details, or children listed as emergency contacts. Once data appears on criminal forums, it spreads quickly and is difficult to remove completely.

The Doxxing and Identity-Chain Implications

A single leaked medical file rarely stays isolated. Attackers combine the clinic’s data with other breaches to build detailed profiles. An email address from the WJ Wonjin files can be matched to gaming accounts, social-media handles, or family addresses. This creates an identity chain that leads to doxxing, account takeovers, and further extortion. Credential leaks like this one routinely cascade into gaming account compromises, especially for children and teenagers who reuse passwords or email addresses tied to family medical records.

Black X Ransomware Group Track Record

Public reporting attributes the Black X ransomware operation to a group that emerged in late 2024. The group has targeted healthcare providers, manufacturers, and professional service firms across Asia and Europe. Its typical playbook involves initial access through compromised remote desktop credentials or phishing, followed by exfiltration of sensitive files before deploying ransomware. Black X then demands payment to prevent publication, using leak sites to apply public pressure. Prior victims include mid-sized clinics and private hospitals where patient data was used as leverage.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure is caught in hours rather than months.
• Rotate any password you used at WJ Wonjin or any related medical portal anywhere it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that chain back to the same contact details.
• Let remediation specialists handle takedown requests across data brokers and leak forums so you do not have to negotiate with threat actors yourself.

The incident shows that even specialized medical clinics remain targets and that stolen records can fuel long-term identity abuse. Taking concrete steps now limits how far the breach can reach. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and 100-plus platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-based takeovers. Start your DoxxScan trial today to regain control of what attackers already hold.