HOLLYS says attackers got into a cloud membership service between 3 September and 7 October, and ~2.76 million sets of customer information went with them. This is an account-takeover breach, not a phishing-kit breach: the file holds member IDs and passwords, and those pairs are live in someone else's hands. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. Change your passwords now, everywhere you reused them.
What HOLLYS put in writing
The disclosure landed on 19 October across the Korean press: the Korea Times, Yonhap, MoneyToday, ChosunBiz and outlets including Segye Ilbo. HOLLYS put up its notice on 16 October, around 9:36 PM, then issued a fuller statement on the 19th telling members to change their passwords, on HOLLYS and anywhere else they used the same ID and password.
The company reported about 2.76 million sets of personal information to KISA, the Korean internet security agency: customer data accumulated from 2009 to 11 February 2020, duplicates included. That is sets of information, not 2.76 million people; HOLLYS has not given a headcount. Eleven years of accumulation, then six more years of sitting. That is not an archive. It is a liability. The affected set is members who joined before 11 February 2020. Nine fields are listed: member IDs, passwords, names, dates of birth, phone numbers, addresses, emails, DI (the duplicate-registration check value) and service usage records.
Two claims from the company's own account deserve care. First, HOLLYS says the data came from temporary files kept during a past membership service overhaul, not the live customer database. That would explain why people who stopped buying HOLLYS coffee years ago are in the file. It also means a filing cabinet from 2009 was still sitting in a cloud service in 2026, six years after the cutoff date. Temporary, apparently, is doing a lot of work in that sentence.
Second, the company says it assesses the attackers broke in to mine cryptocurrency, with customer data swept up along the way. That is HOLLYS's own working theory, from a single report, still under investigation. Treat it as the company's explanation, not a settled cause. Reports also differ on when HOLLYS itself detected the access, so do not trust any single date you see quoted; the company has not settled that point in its own statements.
What the company has not said: whether the leaked passwords were stored encrypted. Whether the data has been misused. How many real people sit behind those 2.76 million sets. Those are the gaps to watch, and the investigation is still open.
The password pair is the weapon
Most breaches hand attackers a phone book. This one handed them keys.
Read the leaked file the way an attacker reads it. Each row pairs a member ID with the password that went with it, and an email address sits in the same row. Where the member ID is the email address itself, that row is a finished login: no guessing, no phishing, no brute force needed. Where the ID is a HOLLYS-specific username, the pair still feeds straight into stuffing software, which tries each credential quietly against email providers, shopping sites and banks, a few attempts per account to stay under the rate limits. Some fraction works, because some fraction of people used the exact same pair somewhere else. Every hit is a full account, not a phishing lead. Nobody types these in by hand. Stuffing is software, and a file like this is its input. The DI field, the duplicate-registration check value, sits in the row too, tying each record to one verified person.
That is why the email address in this file is the key, not the bait. HOLLYS seems to understand that: its statement told members to change not just the HOLLYS password but the same ID and password combination on other services. The credential-stuffing walkthrough covers the mechanics in full. The short version is that an old password you forgot about is still a working password to someone holding the file.
The email address was the expendable one
The one field in the leaked file you controlled was the email address. An email alias made for HOLLYS alone, forwarding to your real inbox, changes what that row is worth. The address belongs to exactly one service, so it cannot be paired with your accounts anywhere else by address. And when the leaked data starts circulating, the leak-tracing mechanism reads the alias and names the source at a glance: a message lands on the HOLLYS address and you know where it escaped from. Kill the alias and the channel dies while your real inbox never hears from it again. The set-up guide takes about two minutes. It also narrows what the attacker's file can do: with one address per service, the HOLLYS row cannot be chained to your accounts anywhere else by email.
Coffee-shop memberships are the signups nobody audits. You hand over the real address for the points, the account sits untouched for a decade, and the data ages in a file you forgot existed. Then the file walks out.
The part an alias cannot fix is the password. The ID-and-password pair is the weapon in this breach, and an alias guards the address, not the secret. If you signed up with your everyday email and a password you used in six other places, the alias never enters the story. Password reuse is still on you. It always is.
If you joined before 11 February 2020
The pairs are live, so work in this order. Nobody remembers a coffee-shop signup from 2012, which is exactly why this one bites.
- Change your HOLLYS password now. The data is old. The credential pair sitting in someone else's hands is current.
- Change the same ID and password combination everywhere else it appears, starting with your email account. Password-reset emails land in your inbox, so whoever owns the inbox owns the recovery path for every account tied to it. If it falls, the rest follows.
- Turn on two-factor authentication on your email. Leaked names, birth dates and phone numbers are the raw material of account-recovery calls, and 2FA is the step an attacker cannot talk their way through.
- Treat any call, text or email about this breach from an unknown sender as the attack itself. HOLLYS says it never sends links by SMS and never asks for passwords or payment details. Anyone doing that is proving they have the file, not that they work for HOLLYS.
- Check Have I Been Pwned once the incident is listed, then run the breach-response order of operations.
What the investigation still owes
Three gaps, then this can be closed out. First, the passwords: until HOLLYS says whether they were encrypted, the working assumption has to be that they were readable. Second, the headcount: 2.76 million sets of information is a file size, not a victim count, and nobody has named the number of people behind it. Third, the data's movement: whether the file has travelled past the intruders, and what "may have been taken" settles into once the investigation lands.
The cloud membership service that was breached is suspended while HOLLYS inspects its systems. Suspension is containment, not a fix. The file is already out. Old files need watching too.
