Hollys Coffee membership breach in South Korea may have exposed about 2.8 million records

Hollys Coffee, a South Korean coffee chain, detected unauthorized access to its membership system on October 16, 2026 and announced the breach on its website at 9:36 PM that evening. The company suspects the intrusion ran from September 3 to October 7, 2026, and says members who joined before February 11, 2020 are affected. Information that may have been compromised includes member IDs and passwords, names, birth dates, phone numbers, addresses, email addresses, duplicate membership verification information (DI), and service usage records. MLex reports that the breach may have exposed about 2.8 million records and that South Korea's privacy regulator is reviewing it; Hollys itself has not disclosed an exact number of affected individuals, and it has not said whether the information has been misused.

Hollys says it has blocked the unauthorized access routes, strengthened authentication procedures and monitoring of abnormal logins, and is cooperating with the relevant authorities. It notified all members on October 18, and urged members to change their Hollys password and any reused passwords on other services. Because the about 2.8 million figure is a reported potential exposure, not a company confirmed count of records taken, SecurTek lists this breach without adding that figure to the records exposed total, and will update the item when a confirmed count is published.

Sources: Aju Press (reporting Yonhap News and the company's October 16 announcement); MLex