Hollys customers frustrated as coffee chain still assessing scope of data breach

Customers whose personal data was exposed in a hacking of Hollys Coffee's membership system are voicing frustration over delayed notifications and an unreachable customer service line.

One tipster who said they had previously canceled their Hollys membership told Yonhap they received a text message about the data breach on Sunday. When they called the customer service number listed in the message, an automated response system played on a loop with no way to reach a live representative. "They kept my information even after I canceled my membership, and now this has happened," the person added.

Another affected customer who posted in an online community said calls to Hollys simply disconnect without anyone answering. When they called the personal information infringement center listed in the text message, staff told them it was not their responsibility. "I don't know who to contact, so I'm just waiting for a second notice," the customer said.

Hollys became aware of the incident on Friday and initially posted a notice only on its website. It did not send text messages to affected customers until Sunday — two days later. The breach affects customers who signed up for a Hollys membership before Feb. 11, 2020.

Compromised data includes user IDs, passwords, names, dates of birth, phone numbers, addresses, email addresses, duplicate-registration verification information and service usage records. Hollys said it believes the breach occurred through external hacking between Sept. 3 and Oct. 7.

Four days after discovering the incident, the company has yet to determine the full scope of the damage. A representative of KG Group, the parent of Hollys operator KG F&B, said only that it is "currently assessing the extent of the damage." KG Group acquired a 93.8 percent stake in Hollys F&B in September 2020 for 145 billion won ($108 million). The operator has since been renamed, first to KG Hollys F&B and then to KG F&B in 2024.