Wonjin Plastic Surgery Listed by Black X Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Public information shows that on June 02, 2026, Wonjin Plastic Surgery was listed by the Black X ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The number of people affected is not known, and no further details on the incident have been released by the organization or independent sources.

Individuals who have received treatment or worked at the clinic may now face uncertainty about whether their information was among the files taken. Medical providers hold records that can include personal identifiers and health details, so any confirmed exposure would carry practical consequences for privacy and potential misuse.

Inside the incident

The only reported detail is the Black X listing itself, which claims internal files were removed. No information has been made public about when the attack occurred, how access was gained, how much data was involved, or whether the files were later published. The organization has not issued a statement confirming or denying the claims.

The group behind it: Black X

The Black X ransomware group is the entity that placed Wonjin Plastic Surgery on its leak site. The group claims the exfiltration took place as part of a ransomware operation. Public reporting on this actor describes a pattern of targeting organizations and using leak sites to draw attention to stolen data, though no verified details specific to this listing beyond the claim have been confirmed.

Wonjin Plastic Surgery and its sector

Wonjin Plastic Surgery operates as a medical clinic providing surgical and related services. Organizations in this sector routinely collect and store patient registration data, medical histories, treatment records, and billing information to deliver care and manage appointments. A breach at such a facility is consequential because the records often contain information that cannot be changed, such as health details and identification numbers.

What was likely exposed

The listing refers only to “internal files exfiltrated in ransomware attack.” The precise contents of those files have not been disclosed. Clinics of this type commonly hold patient names, contact information, dates of birth, medical notes, procedure records, and payment data, but it remains unconfirmed whether any of these categories were present in the exfiltrated material.

Why it matters

Exposed medical and personal records can be used for identity-related fraud or targeted scams. Patients may need to monitor financial accounts and insurance statements for unusual activity over an extended period. For the organization, the incident adds operational and reputational costs while it addresses any required notifications or security improvements.

What to do if you're exposed

Review statements from Wonjin Plastic Surgery for any official guidance. Change passwords on associated accounts and enable multi-factor authentication where available. Request a copy of your medical records to verify their accuracy. Readers can run a free exposure scan of their email address to check whether their information appears in known breach data sets.

AICompiled with AI assistance from public sources and published under our editorial standards.