South Korean coffee chain Hollys has confirmed that attackers got into its membership system and took customers' personal data. The stolen data includes user IDs, passwords, names, dates of birth, phone numbers and home addresses. The company has apologised publicly. On the 16th it posted a notice titled "Apology and Notice Regarding the Personal Information Breach," saying: "We sincerely apologize for the concern this incident has caused our customers." Sources do not agree on how many people are affected. MoneyToday puts the leak at an estimated 2.76 million records. Hollys's own notice gives no count, and most other outlets, including Newsis, The Herald Business, SBS and Financial News, say the number of victims has not been confirmed or disclosed. No regulator filing or other primary document was available for this brief, so we treat the 2.76 million figure as an unconfirmed media estimate.
What Happened
According to the company notice as reported by several outlets, Hollys confirmed on Friday, 16 October 2026, that unauthorised access to its membership system had led to a data leak. It posted the notice on its website at about 21:36 Korea time that day. Hollys believes the intrusion was "unauthorised external access (hacking)" that took place between 3 September and 7 October 2026. That timeline appears in TSN, Financial News, The Herald Business and SBS. ChosunBiz gives the window as 3 March to 7 April, which conflicts with every other account and is probably a translation error. On the majority figures, the attackers had about 35 days inside the system. BeyondMachines makes the same 35-day estimate.
Affected customers only got text messages on 18 October, two days after the website notice. The Herald Business reports that customers are frustrated. They say the hotline number in the message plays an automated loop with no way to reach a person. Staff at the personal information infringement centre listed in the message reportedly told callers it was not their responsibility. One customer who had cancelled their membership said Hollys still held their data. SBS reported that the Hollys mobile and PC websites were temporarily unreachable. BeyondMachines says the company took both offline on purpose to contain the breach. Four days after discovery, parent company KG Group would only say it is "currently assessing the extent of the damage."
What Was Taken
Hollys says the breach affects members who signed up on or before 11 February 2020. Some outlets write "before" that date and others "on or before," so the cutoff day itself is unclear. BeyondMachines describes the target as a legacy membership database, but no other source confirms this.
Exposed fields, according to the company notice:
- User IDs and passwords
- Names and dates of birth
- Phone numbers, home addresses and email addresses
- Duplicate-registration verification information (DI), a Korean identity-linked code used to check whether someone has already signed up for a service
- Service usage records and related data
Hollys has not said how the passwords were stored (plaintext, hashed or salted). It has also not said whether any of the data has been misused. For record count, see above: estimates go up to 2.76 million (MoneyToday), but the company has not confirmed a number.
Why It Matters
- Credential stuffing risk. Each record links an ID and password to a verified identity. Hollys itself told customers to change reused passwords on other services, which suggests it believes the credentials can be used against other services.
- Smishing and impersonation. Attackers now have names, phone numbers, addresses and birth dates in one place, which is enough to send convincing scam texts posing as Hollys or as delivery and finance companies. The notification itself was sent by SMS, and customers say the support line is hard to reach. Both make it easier for fake follow-up messages to look real.
- Data kept longer than needed. The affected group is defined by sign-ups from six or more years ago, and at least one person whose data was exposed had already cancelled their membership. Old member data that was never deleted made this breach bigger, and Korean privacy regulators are likely to look at that.
- Context. This is one of a run of recent corporate leaks in South Korea. Outlets note that it shows everyday consumer brands are targets too.
The Attack Technique
Hollys has not said how the attackers got in. It describes the incident only as unauthorised external access to its membership system. Its fixes were to block the access route, strengthen authentication and step up monitoring of abnormal login attempts. That points to an authentication or account-access weakness, but this is our inference and Hollys has not confirmed it. Reports describe the attackers taking data over about five weeks before anyone noticed, which points to weak monitoring of bulk data access. Hollys says it reported the incident to the relevant authorities and is cooperating with the investigation. BeyondMachines names the Personal Information Protection Commission (PIPC) as one of those authorities. No threat actor has claimed the attack.
What Organizations Should Do
- Delete old account data. Enforce retention limits and actually purge data from cancelled and dormant accounts, especially for loyalty programs that have run for years.
- Store passwords with modern hashing. Use Argon2, bcrypt or scrypt with unique salts. Then a database dump does not hand attackers credentials they can use straight away.
- Watch for bulk data access. Alert on unusual query volume, large exports or access from unexpected locations against customer databases. Five weeks of undetected access is far too long.
- Plan the notification channel in advance. Have a staffed hotline and clear contacts ready before notifying customers. Tell customers through more than one channel so that scam messages are less believable.
- Prepare for credential stuffing. If your users may overlap with this customer base, turn on breached-password checks, rate limiting and MFA prompts for logins that look like credential reuse.
- Warn customers about scam texts. Tell them plainly that you never send links or ask for passwords by text, as Hollys did, and keep repeating it.
Sources: Hollys, passwords and other personal data: 2.76 million records est... | Hollys customers frustrated as coffee chain still assessing scope o... | Hollys Coffee Says Hackers Leaked Member Data TSN | Hollys Coffee hit by data breach, exposing customers' names, addres... | “Phone numbers and home addresses exposed too” ... Hollys customer... | Hollys Customer Addresses Leaked… Users Urged to ... | South Korea's Hollys Coffee Membership System Compromised | Hollys confirms customer data breach, urges immediate ...