Hollys Coffee Says Hackers Leaked Members’ IDs, Passwords and Addresses

Hollys, a South Korean coffee chain, says hackers got into its membership system and leaked customers’ personal data, including user IDs, passwords, names and addresses. The company has not said how many people are affected. It says the leak hit members who joined on or before 11 February 2020.

What Hollys says happened

Hollys set out the details in a notice on its website, posted on 16 October at 21:36 Korea time (13:36 UK time). “Unauthorised access occurred to our membership system, and we confirmed on 16 October 2026 that customers’ personal information had been leaked,” the notice says, in TSN’s translation from Korean.

According to the notice, the data is presumed to have been leaked through “unauthorised external access (hacking)” between 3 September and 7 October 2026. Hollys also sent customers a text message about the incident on 18 October, Korean news agency Newsis and business daily Hankyung report.

What was leaked

Hollys lists these items as leaked:

• user IDs and passwords
• names and dates of birth
• phone numbers, addresses and email addresses
• duplicate-subscription verification information, known in Korea as DI, a code used to check whether a person has already signed up for a service
• other information related to use of the service

The notice says the affected group is customers who joined the Hollys membership on or before 11 February 2020. Hollys has not said how many members that covers. “The specific scale of the leak and the number of victims have not been confirmed,” Newsis reports, in TSN’s translation.

Hollys has not said how the attackers got in, or how the passwords were stored.

What Hollys has done

According to its notice, Hollys has:

• blocked the route used for the unauthorised access and strengthened its authentication procedures
• stepped up monitoring of abnormal login attempts
• reported the incident to the relevant authorities and is cooperating with the investigation

It did not name the authorities. Newsis reported that the Hollys website was still hard to reach at about 18:50 Korea time on 18 October.

“We deeply apologise for causing concern to our customers through this incident,” Hollys says in the notice. “We will do our best to protect customer information and minimise harm.”

What members should do

Hollys gives customers this advice in its notice:

• Change your Hollys password now.
• Change your password on any other service where you use the same ID and password. This matters because the leaked items include both IDs and passwords.
• Do not respond to calls, texts or emails of unclear origin, and do not click links in them.
• Know what Hollys will not do. Hollys says it does not send links by text and does not ask for passwords or financial or payment information.

Hollys lists its customer centre on 02-2188-7100 (weekdays 09:00–18:00). For help with damage, it points customers to Korea’s personal information infringement report centre on 118 and the Personal Information Dispute Mediation Committee on 1833-6972.

Separately, Hollys posted a notice on 7 October saying its website and all app services will be offline for a server migration from 00:00 to 06:00 Korea time on 19 October (16:00 to 22:00 UK time on 18 October). That notice does not mention the breach, and Hollys has not linked the two.

A different date in English

ChosunBiz’s English-language report gives the leak period as 3 March to 7 April. Hollys’s own notice, and the Korean reports by Newsis and Hankyung, give 3 September to 7 October 2026. TSN uses the dates in Hollys’s notice.

Part of a run of Korean retail leaks

Hankyung notes that customer data leaks have been piling up in Korean retail. It reports that Parnas Hotel & Resort members’ data was leaked through outside hacking last month, and that about 150,000 customer records were leaked from fashion platform 29CM in August.

What we don’t know

• How many members are affected.
• How the attackers got into the membership system.
• How the passwords were stored.
• Which authorities Hollys has notified.

What this means

• Hollys says hackers reached its membership system between 3 September and 7 October 2026, leaking IDs, passwords and contact details of members who joined on or before 11 February 2020.
• It has not said how many people are affected.
• Members should change their Hollys password, change it anywhere else they reuse it, and ignore unexpected messages asking for passwords or payment details.

Sources

• Hollys: Apology and notice regarding personal data leak, 16 October 2026 (Korean)
• Hollys: Notice of temporary service suspension, 7 October 2026 (Korean)
• Newsis: Hollys customer data leaked in hacking (Korean)
• Hankyung: Hollys customer data leaked (Korean)
• ChosunBiz: Hollys confirms customer data breach, urges immediate password changes

Related stories

• Nikkei Says 1.83 Million Personal Data Items Leaked From a Development Cloud
• Yamato Transport Says About 5.26 Million Pay-Later Customer Records Were Taken
• Hackers Hit Romanian Central Depository’s Investor App, Viewing Personal Data