Hollys data breach: what was exposed and what to do

In short: Hollys, a South Korean coffee chain, began notifying customers on October 18, 2026 that hackers had broken into its membership system and exposed 2.76 million customer records, including IDs, passwords, names, birth dates, phone numbers, addresses and emails, according to Financial News. The exposed files belonged to people who had signed up before February 11, 2020, not current account holders, and the company has not disclosed how many individual people were actually harmed.

What data was exposed in the Hollys breach?

The leaked files included user IDs and passwords, names, dates of birth, phone numbers, addresses, email addresses, and "duplicate membership verification information (DI)," according to Financial News. Hollys reported a scope of roughly 2.76 million records to South Korea's internet security agency, but said the exact figure was still being confirmed, per ZDNet Korea.

Hollys breach 2.76 million: whose records were in that count?

That number is an estimate covering customers who joined Hollys membership between 2009 and February 11, 2020, and it includes duplicate entries from people who signed up more than once, according to ZDNet Korea. Hollys said the figure does not involve currently active membership records. The company has not said how many distinct customers were actually affected once duplicates are removed, or whether any leaked data has surfaced elsewhere, as reported by Insight.

How did the Hollys membership breach happen?

Hollys detected unauthorized outside access to its membership system on October 16, 2026, and believes data was taken between September 3 and October 7, according to Financial News. Investigators believe the intrusion targeted Hollys' cloud infrastructure for cryptocurrency mining, and customer data was exposed as a side effect, ZDNet Korea reports. The exposed files were not the live customer database but leftover temporary data from a past overhaul of the membership system, per the same report. Hollys' mobile and PC websites were also inaccessible for a period around the disclosure, according to Insight.

What should I do if my data was in the Hollys breach?

Hollys posted a notice on its own site and sent customers notification texts on October 18, urging quick action, according to Insight. If you ever held a Hollys account, especially from before 2020, work through this checklist:

1. Change your Hollys membership password now, as the company itself has asked customers to do.
2. Change the password on any other account that reused the same ID and password combination, since Hollys specifically flagged reused credentials as a risk.
3. Treat unexpected calls, texts or emails claiming to be from Hollys with suspicion; the company says it never sends links by text or asks for passwords or payment details.
4. Avoid clicking links in messages about your Hollys account; go directly to the official app or site instead.
5. Watch your email and any account tied to the phone number or address in your old Hollys profile for unusual login attempts.
6. Assume your name, birth date and contact details could be used to make scam messages look convincing, and stay alert to anything referencing them.
7. Keep checking for updates from Hollys, since the company says it is still assessing the scope of harm.

For more detail, see our guide on steps to take if your password was exposed.

How can I recognize phishing that uses this leaked data?

Breached names, birth dates, phone numbers and addresses are commonly reused to craft convincing scam messages, so any unexpected contact that references your real details deserves scrutiny. General digital-security guidance from Denmark's government advises staying alert to texts, calls and emails that cite personal details about you, avoiding unexpected links, and never sharing passwords, one-time codes or payment information with anyone who contacts you out of the blue, according to Sikkerdigital.dk. That advice applies to anyone dealing with a leak like this one, not just Danish residents. Our explainer on spotting phishing scams after a data breach walks through common warning signs.

If you already clicked a suspicious link or handed over card details or login information after one of these messages, act immediately rather than waiting to see if anything happens: call your bank to block any card you gave out, file a police report, and if your government ID or login credentials were involved, use that report as documentation for any provider that later asks you to prove the misuse wasn't yours, according to Sikkerdigital.dk.

What hasn't Hollys confirmed yet?

Several details remain open. Hollys has not said how many individual customers were actually affected, separate from the 2.76 million total records that include duplicates, nor has it said whether leaked data has been misused outside the company, according to Insight. Whoever carried out the intrusion has not been identified; investigators suspect a cryptomining motive but have not named an attacker, per ZDNet Korea. Hollys says it has blocked the unauthorized access route, strengthened authentication, increased monitoring for abnormal logins, reported the incident to authorities, and plans to shut down the membership service that used the affected cloud system, according to Financial News. A company representative said: "We will do our utmost to protect customer information and minimize harm," per the same report.

Updated 28 October 2026: Added a paragraph on what to do if you've already clicked a phishing link or shared details tied to the Hollys breach, with the correct source link.