▲ A citizen passes by a Hollys store in Seoul.
Customer personal information has reportedly been leaked after the membership system of the coffee chain Hollys was hacked.
According to the coffee industry on October 19, Hollys confirmed that unauthorized external access to its membership system occurred on October 16, resulting in a data leak, and posted a notice regarding the incident on its official website at around 9:36 p.m. that same day.
Hollys urged customers to "immediately change your membership account passwords" and advised, "Please also change passwords for other services that use the same ID and password."
The company further emphasized, "Do not respond to or click links in phone calls, text messages, or emails from unknown sources," adding, "Hollys does not send links via text message nor does it request passwords, financial, or payment information."
"We deeply apologize for causing concern to our customers due to this incident, and we will do our utmost to protect customer information and minimize damage," it added.
The customers whose information was leaked are those who signed up for Hollys membership prior to February 11, 2020.
However, specific details such as the exact number of affected customers and whether the leaked information has been exploited externally were not disclosed.
The leaked items include IDs, passwords, names, dates of birth, phone numbers, addresses, emails, Duplication Information (DI), and other service usage information.
Amid a recent series of personal information leak incidents at companies, consumer anxiety is expected to grow as it has been revealed that customer information was leaked from a coffee shop used in daily life.
The previous day, access to the Hollys mobile and PC websites was disrupted for a while.
Hollys estimated that the personal information was leaked due to external hacking between September 3 and October 7.
Hollys stated that it has blocked unauthorized access routes, strengthened authentication procedures, and enhanced monitoring for abnormal login attempts.
It also noted that it has reported the incident to relevant authorities and is cooperating with the investigation.
However, it was found that even today, four days after recognizing the incident, Hollys has yet to properly grasp the scale of the affected customers.
An official from the KG Group, to which KG F&B, the operator of Hollys, belongs, told Yonhap News today, "We are currently assessing the scale of the damage."
In particular, it was found that after recognizing the incident on October 16, Hollys only posted the relevant information on its website and notified customers via text message two days later on the previous day.
An informant who stated that they had previously joined and then withdrawn from Hollys membership told Yonhap News, "Yesterday, I received a text message from Hollys regarding the information leak," raising suspicions that "Hollys kept the registration information of withdrawn members without deleting it, leading to this situation."
The informant also expressed frustration, saying, "To check the details, I called the Hollys customer center listed in the text message, but the ARS (automated response system) guide just repeated endlessly, and there was no way to speak directly with a representative."
Previously, in September 2020, the KG Group acquired a 93.8% stake in Hollys F&B for 145 billion KRW.
The operating company subsequently changed its name to KG Hollys F&B and then to KG F&B in 2024.
(Photo: Yonhap News)
※
Copying, redistribution, and unauthorized use in AI training are strictly prohibited.