The record has to preserve the limits of the disclosure.
Weverse Company disclosed the incident after KISA relayed an external vulnerability report and the company completed an internal review. The company said 422,584 account IDs were exposed alongside purchase-related metadata.
It also said that direct identifiers such as names and contact details were not within the confirmed scope. That detail should not disappear in the headline. A large number can be serious while still describing a different risk from an exposure of identity and contact data.
Why internal identifiers can still deserve attention.
An internal account ID may be hard to use in isolation. Combined with purchase activity, service history or another dataset, however, it can make targeted impersonation more believable. That is why the safest response is to use the official service, not a link in a message that claims to be about the incident.
The record does not establish that every user’s purchases were visible, nor that an affected identifier directly identifies a person. Those are different questions. The company’s notice and the linked reporting are the appropriate place to watch for a scope update.
A proportionate response for users.
Check the account through the official Weverse app or website. Use a unique password and enable the strongest sign-in protection offered. Review order history if the company asks users to do so, but do not enter payment information in response to an unsolicited email or direct message.
This is also a good reminder that incident reporting should distinguish between what an organisation has confirmed, what it says is excluded, and what remains under investigation. Those boundaries help people react without being misled into either panic or complacency.