Short answer
Hollys Coffee confirmed on 16 October 2026 that its membership system had been hacked between 3 September and 7 October. Members who joined before 11 February 2020 are affected. Yonhap reports the leak as about 2.76 million records.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Hollys Coffee |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Coffee shop chain |
| Country | South Korea |
| Detected | 2026-10-16 |
| Disclosed | 2026-10-16 |
| People or records affected | About 2.76 million records, according to Yonhap. The count includes duplicate entries, so it overstates unique people. |
What data was exposed
- Login IDs and passwords
- Names and dates of birth
- Phone numbers, home addresses and email addresses
- DI value used to check for duplicate memberships
What happened
Hollys Coffee, a South Korean coffee chain, said it confirmed unauthorized access to its membership system on 16 October 2026 and disclosed the leak on its website. SBS Biz reports the intrusion is estimated to have run from 3 September to 7 October. Newstomato gives a shorter window, so the exact period is not settled.
Who and what
Members who joined before 11 February 2020 are affected. The exposed items are login IDs and passwords, names, birth dates, phone numbers, addresses, email addresses and a DI value used to check for duplicate memberships. Neither article says whether the passwords were stored in hashed form.
On 19 October Hollys announced a leak of about 2.76 million records, according to Yonhap. That count covers membership data from 2009 to February 2020 and includes duplicate entries for some members, so the number of unique people is lower. Yonhap ranks it the largest single case among 25 organizations that reported leaks in October.
What Hollys says
Hollys said it blocked the unauthorized access route and strengthened authentication and monitoring for abnormal logins. It told members to change their membership passwords and to change passwords on other services where they used the same ID and password. It also warned members not to respond to or click links in unfamiliar calls, texts or emails, and said it does not ask for passwords or financial or payment information by text. It reported the incident to the relevant authorities. The articles we reviewed do not name a regulator, and we have not seen a regulator finding.
Why reused passwords are the main risk
When a login and password leak together, attackers test the pair on other sites. A name, birth date and address also help a caller sound like a bank or delivery firm. Our phishing messages guide and account takeover guide cover how to spot and recover from this, and the data breach checklist lists the first steps.
What to watch next
Watch for a Personal Information Protection Commission decision and any update to the record count. More October incidents are on our breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Credential stuffing: attackers try your Hollys ID and password on email, shopping and banking sites if you reused them.
- Texts or calls posing as Hollys that ask for a password, payment details or a click on a 'membership recovery' link.
- Smishing and voice phishing that use your name, birth date, phone number and address to sound genuine.
- Fake coupon or gift card messages that mention Hollys membership.
What to do if you are affected
- 01Change your Hollys membership password now, and change it everywhere else you used the same ID and password.
- 02Turn on two-step verification on your email and any account that shared the password.
- 03Ignore texts, calls or emails asking for passwords or payment details. Hollys says it never asks for these by text.
- 04Do not click links in unexpected messages. Go to the Hollys app or official site yourself.
- 05Report suspicious messages to KISA on 118 and voice phishing to the police on 112.
Frequently asked questions
Who is affected by the Hollys breach?
Members who joined the Hollys membership program before 11 February 2020. The data dates from 2009 to February 2020.
Were passwords exposed?
Yes. SBS Biz and Newstomato list login IDs and passwords among the exposed items. Hollys asked members to change their membership passwords immediately.
How many people are affected?
Yonhap reports about 2.76 million records. Some members appear more than once, so the number of unique people is lower.
When did the intrusion happen?
SBS Biz reports it is estimated to have run from 3 September to 7 October 2026. Newstomato reports a shorter window, so the exact period is not settled.
Sources
- Hollys hacked, customer data leaked: passwords and addresses taken (Korean-language article, headline in English), SBS Biz, 2026-10-18
- Hollys customer data leak, password change requested (Korean-language article, headline in English), Newstomato, 2026-10-19
- October: about 5.34 million records leaked at 25 companies and institutions (Korean-language article, headline in English), Yonhap News (via Korean Center), 2026-11-01
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.