A major privacy scandal has erupted in South Korea after CCTV footage recorded inside hospitals and medical clinics was allegedly hacked and circulated on overseas adult websites. Over 100 patients' faces and nude images were found on porn sites.
Around 80 videos from South Korean medical facilities have so far been identified, according to an investigation by the office of Democratic Party lawmaker Heo Jong-sik. The footage reportedly came from obstetrics and gynaecology clinics, plastic surgery centres, Korean medicine clinics and rehabilitation facilities.
South Korean police have now opened an investigation into how the footage was obtained and subsequently redistributed.
Patients' Medical Visits Recorded Without Their Consent
The leaked footage reportedly shows patients moving through different areas of medical facilities, including waiting rooms, consultation rooms, ultrasound rooms and examination rooms.
Some recordings also show medical procedures and patients changing into hospital clothing. Footage from other clinics allegedly captured injections, consultations, plastic-surgery procedures, acupuncture and rehabilitation treatments. The recordings reportedly carry dates ranging from February 2022 to November 2025.
The exposure has raised serious concerns over the security of cameras installed inside healthcare facilities, where patients would reasonably expect a high level of privacy.
Police Investigate How Hospital CCTV Footage Was Hacked
The Korean National Police Agency received a request for an investigation from lawmaker Heo on 29 September and assigned the case to the North Chungcheong Provincial Police Agency. The investigation is not limited to the original theft of the footage.
According to Yonhap, four people suspected of initially hacking, distributing and selling the footage were arrested last year. Authorities subsequently sought to block websites carrying the illegally obtained videos and took measures to protect victims.
However, the recordings later appeared on other websites, prompting authorities to investigate those accused of redistributing the material.
Why IP Cameras Are at the Centre of the Investigation
Much of the leaked material is believed to have been captured by internet-connected IP cameras. Unlike traditional closed-circuit systems that operate within a more limited network, IP cameras can connect to wired or wireless networks and transmit footage to other devices in real time.
That connectivity can make them useful for hospitals and businesses, but it can also create additional cybersecurity risks when cameras, passwords, network configurations or access permissions are inadequately protected.
Authorities have not yet publicly established exactly how the cameras involved in this case were compromised.
A Gap in South Korea's CCTV Rules?
The scandal has also exposed a potential gap between CCTV rules covering operating rooms and the wider use of cameras elsewhere inside medical facilities.
South Korea amended its Medical Service Act in September 2023 to make CCTV installation and operation mandatory in operating rooms where patients are unconscious because of anaesthesia.
The rules also require measures intended to prevent unauthorised access and leaks, including password protection, access-log management and restrictions on access privileges.
But investigators say the newly identified footage was not confined to operating rooms.
Lawmaker Calls for Nationwide Security Review
Heo has urged South Korea's Ministry of Health and Welfare to conduct a comprehensive review of CCTV security at medical institutions. The lawmaker also called for police and other agencies to determine how the footage was leaked, establish responsibility and work to remove the recordings and prevent further redistribution.
'With footage of people receiving medical treatments and changing clothes circulating, how can the public feel safe going to the hospital?' Heo said, according to SBS. The concern extends beyond the individual clinics identified in the investigation.
According to data submitted by the Ministry of Health and Welfare to Heo's office, South Korean medical institutions reported 109 cybersecurity incidents between 2021 and August 2026. Most involved ransomware, although none of those reported incidents involved leaked CCTV footage.
