South Korean coffee chain Hollys says hackers took membership passwords, addresses and phone numbers

TLDR

• Hollys says an outside party accessed its membership system, confirmed on 16 October, exposing passwords, addresses and phone numbers.¹²
• Members who joined before 11 February 2020 are affected; Hollys reports about 2.76 million records to KISA, duplicates included.¹²⁵⁶
• Sources differ on the intrusion window: 3 September to 7 October (Yonhap, News1) versus 3 March to 7 April (Chosunbiz).¹²³

Yonhap reports that Hollys confirmed on 16 October that an unauthorised outside party had accessed its membership system and posted a notice on its website at about 9:36 pm that day.¹ News1, carried by The Dong-A Ilbo, says Hollys then sent affected customers individual text messages on 18 October.³ The exposed items include user IDs and passwords, names, dates of birth, phone numbers, addresses, email addresses and duplicate-subscription verification information (DI), and affect customers who joined the membership before 11 February 2020 (Chosunbiz writes "on or before").¹²³ Hollys's first notice gave no count of affected customers (see the update below) and did not say whether the data has been misused, and it told members to change their passwords at once, including on any other service where they reuse them.¹ The company said it has blocked the access route, strengthened authentication and monitoring for abnormal log-ins, reported the incident to the relevant authorities and is cooperating with their investigation.¹²

On the timing, Yonhap and News1 both describe the leak as presumed to have occurred between 3 September and 7 October.¹³ Chosunbiz, which also cites the company, writes 3 March to 7 April.² The two Korean-language reports quote the company's notice and text message, and their range fits a leak confirmed on 16 October, so they are the better guide, but the discrepancy is unresolved in the sources.¹³

Hollys also told customers not to respond to, or click links in, calls, texts or emails of unclear origin, and said it never sends links by text or asks for passwords or financial and payment details.¹ The reports reviewed do not say how the passwords were stored.¹²³

Why it matters: passwords paired with addresses, phone numbers and birthdates make credential-stuffing and phishing against the same people easier, and the company's own advice to reset reused passwords reflects that risk.¹³

Update, 21 October 2026: Hollys has now given a figure for the breach. In a notice posted on 19 October, the company said the number of records reported to the Korea Internet & Security Agency (KISA) was about 2.76 million and that it is still verifying the exact scale, according to The Asia Business Daily and Korea Biz Daily.⁵⁶ Yonhap's English service gives the same total, which it describes as pieces of personal information.⁴ The figure counts records, not customers, and the company says it includes duplicate memberships.⁵

The company said the exposed data appears to be a temporary data file provided for a past overhaul of the membership service, not the database of currently active customers.⁴⁵⁶ The Asia Business Daily says Hollys estimates the data is cumulative customer records from 2009 to 11 February 2020, and Korea Biz Daily says those affected joined before 11 February 2020.⁵⁶ Hollys now attributes the intrusion to an outside party that accessed its cloud service abnormally in order to mine cryptocurrency.⁵⁶

On timing, Yonhap's English report and the Asia Business Daily give the period of the leak as 3 September to 7 October, as do Yonhap and News1 in the earlier sources, and Korea Biz Daily says the hack ran from the 3rd of last month to the 7th of this month.¹³⁴⁵⁶ Chosunbiz's earlier report gave 3 March to 7 April.² Yonhap's English report adds that Hollys has about 530 outlets and is owned by KG Group, and that the breach follows leaks at local financial firms, with financial regulators presuming around 100,000 cases of leaked personal information across 16 financial institutions as of Friday 16 October.⁴