MICIN: credential stuffing against the curon online clinic service led to unauthorized logins to clinic and patient accounts

1. 2026-10-23

   Unauthorized logins were found, apparently credential stuffing with ID and password pairs obtained elsewhere. Traffic from the attacking sources was blocked the same day. [1]

2. 2026-10-27

   Public disclosure; the Personal Information Protection Commission had been informed. [1]

• Clinics: 6 accounts at 5 medical institutions were logged into, and at 3 of them the data of 73 patients was viewed: names, contact details, birth dates, addresses, genders, chart and patient card numbers, visit details and doctors' notes. Names and email addresses of medical staff were also viewed. [1]
• Patients: 14 accounts were logged into, exposing names, contact details, birth dates, addresses, genders and more. [1]
• For some patients, prescription images and consultation records and usage history were included too. No ID documents or passwords were involved, and the company holds no card data. [1]

There are no signs of a break-in to its servers or databases, and no fraudulent payments or other harm had been found. The service was not stopped. [1]

The company reset the passwords of the affected accounts and of all accounts without two-factor authentication, and logged out every clinic account. It stepped up monitoring for suspicious logins and plans stronger login protection. Affected clinics and patients were contacted individually. [1]

Clinics should turn on two-factor authentication and use a password not used elsewhere. Patients are advised to use a unique password and the passkey feature of their device, such as fingerprint or face recognition. [1]