---
title: Hollys experiences personal information breach involving membership data
url: https://www.dataloco.com/en/hollys-experiences-personal-information-breach-involving-membership-data
published: 2026-10-22T16:20:31+00:00
language: en
section: Security
source: https://www.dailysecu.com/news/articleView.html?idxno=208936
publisher: Dataloco
---

# Hollys experiences personal information breach involving membership data

A personal information breach involving membership data, including user IDs and passwords, occurred at the coffee chain Hollys. The breach reportedly includes past members' addresses and duplicate membership verification information, necessitating a review of password protection methods and member data management practices.

According to the notification provided to customers by Hollys, the company confirmed unauthorized access to its membership system on October 16, leading to the data breach. The estimated period during which personal information may have been compromised is from September 3 to October 7. There is a discrepancy between the date the breach was identified and the suspected period of actual data exposure.

Customers who signed up for the Hollys membership before February 11, 2020, are included in the notification. The compromised information includes user IDs, passwords, names, birth dates, phone numbers, addresses, emails, duplicate membership verification information, and other service-related information.

On October 16, the company posted an apology and information regarding the data breach on its website. A follow-up notice concerning the breach was also added to the official site on October 19.

Key aspects to verify include the methods used for password storage and protection. The mere inclusion of passwords in the breached data does not confirm that the original passwords were exposed. It is crucial to ascertain whether the leaked values are in their original form or have been hashed, along with the algorithms and salt applications used, to accurately assess the risks involved.

The scale of the impact must also be determined by distinguishing between the number of data records and the actual number of affected customers, as the extent of impact may vary depending on whether duplicate membership information is included and which specific data was compromised for each customer.

## This story in other languages

- [Deutsch](https://www.dataloco.com/de/kaffeekette-meldet-datenleck-bei-mitgliedern)
- [Español](https://www.dataloco.com/es/incidente-de-filtracion-de-datos-en-una-cadena-de-cafeterias)
- [Italiano](https://www.dataloco.com/it/fuga-di-dati-personali-dei-membri-di-hollys-incluse-le-password)
- [Nederlands](https://www.dataloco.com/nl/hollys-wachtwoorden-en-persoonlijke-gegevens-van-leden-gelekt)
- [Русский](https://www.dataloco.com/ru/kofeinaia-set-xallis-podtverdila-utecku-licnyx-dannyx-klientov)
- [Português (Brasil)](https://www.dataloco.com/pt-br/hollys-sofre-vazamento-de-dados-de-clientes)
- [Svenska](https://www.dataloco.com/sv/hollis-losenord-inklusive-medlemsinformation-lackta)