Coffee chain Hollys has disclosed that an unauthorized external intrusion exposed personal information belonging to some members of its loyalty program. The company said it confirmed the breach on October 16 and notified affected customers by text message on October 18.
Hollys estimates that the unauthorized access occurred between September 3 and October 7. The information involved included account IDs, passwords, names, dates of birth, telephone numbers, addresses, email addresses and duplicate-registration verification information known as DI, along with other service-related data.
- Estimated intrusion period
- September 3 to October 7, 2026
- Breach confirmed
- October 16, 2026
- Customers notified
- October 18, 2026
- Affected membership group
- Customers enrolled before February 11, 2020
The company identified customers who joined the Hollys membership program before February 11, 2020, as the affected group. Available reports did not specify how many accounts were exposed or establish whether the information had been misused, so the overall scale and consequences remain undetermined.
Customers who received the notice should change their Hollys password immediately. Anyone who reused the same ID and password on another service should also replace those credentials there, preferably with a unique password for each account. Unsolicited calls, text messages and emails warrant particular caution because the exposed contact and identity details could be used to make fraudulent approaches appear credible.
Containment measures and unresolved questions
Hollys said it blocked the route used for the unauthorized access, strengthened authentication procedures and expanded monitoring for abnormal logins. It also reported the incident to the relevant authorities and said it would cooperate with their investigation.
The investigation must still establish the number of affected members, how the attacker entered the system and whether exposed information was copied or subsequently abused. Further notices from Hollys or investigating authorities will be important for determining whether customers need safeguards beyond password changes and heightened vigilance against suspicious communications.