The reported scope is unusually sensitive.
Healing Paper, which operates Gangnam Unni, reported unauthorised access to an API used to retrieve consultation records. The company reported 219,665 affected domestic and international users, including about 160,000 in South Korea, according to the public reporting linked from the incident record.
The reported categories can include contact details, consultation and treatment information, consultation photographs and, for some people, payment details. These fields can reveal context that a basic email-and-password exposure cannot, which is why the practical risk is higher even before every technical detail is final.
The most likely harm is highly targeted contact.
Health-related context can make a phishing message sound convincing: an appointment, a clinic, a payment, a before-and-after consultation. Treat unexpected messages about any of those topics with extra caution, particularly if they ask for a code, a new payment, or an app installation.
There is no need to prove a message is fraudulent by replying to it. Open the service yourself, use its official support channel, and preserve screenshots of suspicious messages. If a card or account was involved, contact the issuer through its official app or number.
A privacy incident is not a reason to blame users.
People use health and consultation platforms because they need information or care. The responsibility for protecting that context sits first with the service handling it. A public record should make the reported facts accessible without repeating intimate details or inviting speculation about individual users.
For affected users, the useful next step is specific: review any official notice, secure the account, watch for context-rich fraud, and use the correction link if the public record has missed an update. That is more useful than a headline alone.