Hollys breach: about 2.76 million member records leaked, passwords included
Hollys confirmed on October 19, 2026 that unauthorised access to a cloud service holding its membership information leaked about 2.76 million customer records, including member IDs and passwords, names, dates of birth, phone numbers and addresses.
What happened
Hollys, the South Korean coffee chain, said in an official statement on October 19, 2026 that it had confirmed unauthorised access on October 16 to a cloud service that used its membership information, resulting in the leakage of personal data. The company said it assesses that the cloud service was hacked for cryptocurrency-mining purposes and that some customer information was leaked in the process, and it put the leakage period identified so far at September 3 to October 7, 2026. Hollys first detected the unauthorised access on October 16 and announced it on its website that evening, and it sent notifications to all members on October 18. The company said it has blocked the unauthorised access routes, is investigating the detailed circumstances, and plans to discontinue the membership service that used the cloud service.
Who is affected
People who joined Hollys as members before February 11, 2020. Hollys said the scale of the leakage reported through KISA (the Korea Internet & Security Agency) is approximately 2.76 million records — cumulative customer data from 2009 up to February 11, 2020, including duplicate members, so the record count is not necessarily the number of different people. The company said the leaked data is assessed to be temporary data files provided for a past membership service overhaul, rather than the currently active customer database. The leaked items are member IDs and passwords, names, dates of birth, phone numbers, addresses, email addresses, duplicate-registration confirmation information, and service-usage information. Hollys has not said whether the passwords were stored in hashed form.
How serious
The concrete risk is account takeover on other services. Member IDs and passwords leaked together, and because the records run from 2009 to early 2020, the danger is not limited to the Hollys account itself: anyone who used that ID and password combination elsewhere — on email, banking or social accounts — and has not changed it since is exposed to credential-stuffing sign-in attempts on those accounts. The names, dates of birth, phone numbers, addresses and email addresses in the same records also give scammers what they need for targeted phishing that impersonates Hollys with details that check out. Hollys itself urged customers to change reused passwords and not to respond to calls, text messages or emails of unknown origin.
What to do now
Change your Hollys membership password, and — more important — change the password on any other account where you used the same ID and password combination, starting with your email account, and turn on multi-factor authentication wherever it is offered. Do not respond to or click links in calls, text messages or emails of unknown origin that cite Hollys or this breach; contact the company through its official site or stores instead.
Sources: MoneyToday · Aju Business Daily, via Yonhap News