Hollys Coffee Membership Hacked in South Korea — Passwords, Home Addresses Exposed

South Korean coffee franchise Hollys Coffee has suffered a major data breach after its membership system was hacked, exposing extensive customer personal information. The compromised data goes beyond names and phone numbers to include passwords, dates of birth, and addresses. As of October 18, Hollys' mobile app and PC website remain inaccessible.

According to a text message sent to customers on the same day, the company confirmed on October 16 that unauthorized external access to its membership system had resulted in a customer data leak. The breach is estimated to have occurred through hacking between September 3 and October 7 — a span of 35 days from the earliest estimated date of compromise to the final day.

Affected customers are those who joined the membership program before February 11, 2020. The company has not disclosed the specific number of affected customers or whether the leaked information has been exploited externally.

The compromised data includes user IDs and passwords, as well as names, dates of birth, phone numbers, addresses, email addresses, Duplicate Registration Information (DI), and other service usage-related information. The inclusion of particularly sensitive data such as passwords, addresses, and dates of birth raises concerns secondary damage. Customers who use the same ID and password across other internet services could potentially face account takeover.

Hollys stated that it blocked the external access route and strengthened authentication procedures immediately after confirming the incident. The company said it is intensifying monitoring of abnormal login attempts while reporting the incident to relevant authorities and cooperating with investigations.

Customers have been advised to immediately change their membership account passwords, and to also change credentials on other services where the same ID and password are used. The company also urged customers not to respond to phone calls, text messages, or emails from unclear sources, and not to click on attached links.

In the notification message, Hollys said, "We deeply apologize for the concern this incident has caused our customers," adding, "We will do our utmost to protect customer information and minimize damage."

This incident comes amid a series of recent corporate data breaches in South Korea. The revelation that customer information has leaked from an everyday coffee chain is expected to heighten consumer anxiety. Hollys is one of South Korea's major coffee franchises, and with its large membership base, observers note the potential scale of damage could be significant.

Security industry experts point out that even if passwords were stored in encrypted form rather than plaintext, phishing or smishing attacks leveraging the leaked personal information could follow. Data combining addresses, dates of birth, and phone numbers is particularly susceptible to identity theft or financial fraud, requiring heightened vigilance.

Hollys has currently blocked access to its website and app, and has not disclosed a timeline for system restoration. The company stated that as the investigation with relevant authorities is ongoing, it will promptly notify customers of any additional findings.