The number of personal data leakage incidents at domestic coffee franchise Hollys has been found to total 2.76 million cases. While stating “We apologize for the concern caused,” Hollys noted that sensitive information such as passwords, email addresses, and mailing addresses was included among the leaked data, urging customers to change their passwords immediately.
On Monday, Hollys announced in an official statement that unauthorized access (hacking) occurred on the 16th to a cloud service used for membership information. It is estimated that hackers accessed the cloud service through abnormal routes for cryptocurrency mining and stole some customer information.
The scale of personal data leakage reported by Hollys to the Korea Internet & Security Agency (KISA) is approximately 2.76 million cases, which Hollys estimates to be cumulative customer data from 2009 up to February 11, 2020, including duplicate members.
The leakage period identified so far is between September 3 and October 7 of this year. The confirmed leaked items include user IDs, passwords, names, dates of birth, phone numbers, addresses, email addresses, Duplicate Information (DI), and service usage-related information.
Hollys said, “Immediately upon recognizing the hacking incident, we blocked unauthorized access routes to the relevant service, strengthened monitoring of authentication procedures and abnormal login attempts, implemented emergency response measures, and are conducting an internal investigation into the detailed circumstances.” Reporting has been completed to KISA and other relevant institutional investors, and the company plans to actively cooperate with future investigations.
Hollys urged, “To prevent potential damage, please change the passwords for services using the same account information as your Hollys membership account,” adding, “Please be careful not to respond to or click links in calls, text messages, or emails of unknown origin to prevent secondary damage.”
The company added, “We will continuously monitor the possibility of secondary damage caused by the leaked personal data, and based on the cause and vulnerabilities of this incident, we will comprehensively review access permissions, authentication systems, and security systems for personal data, and implement necessary improvement measures.”
It said it plans to promptly suspend the membership service using the relevant cloud.
The company added, “We deeply apologize for the concern caused to our customers by this incident. We will do our best to protect customer information and minimize damage.”
in LIVING
