Science & Tech · Cybersecurity · 4 hrs ago
Hollys data leak exposes information in an old membership file
South Korean coffee chain Hollys said an old membership file was exposed after unauthorized access to a cloud service.
The company reported about 2.76 million records, including duplicates, with data believed to date from 2009 to February 2020.
The file was a temporary copy made for a past membership service revamp, not the database Hollys currently uses.
Exposed information included names, birth dates, phone numbers, addresses, email addresses, and account details.
The incident shows that old copies can remain a security risk even when they are outside a company’s main systems.
A previous breach at Coupang also involved information that had not been deleted after customers left, including some delivery details.
Experts say companies should collect only information they need, control access to copies, and delete data when its purpose ends.
Hollys’ next steps are not stated, but experts call for a review of how personal information is collected, stored, and destroyed.
Hollys confirmed that an unauthorized access incident exposed an old temporary file created for a membership-service update.
The company reported about 2.76 million affected records, including duplicate members, to South Korea’s data protection authorities.
The file was believed to contain customer data accumulated from 2009 to February 11, 2020, rather than data from the current customer database.
Exposed information included account credentials, names, birth dates, phone numbers, addresses, email addresses and service-use data.
Experts said companies should protect data copies, collect only necessary information and delete records when their purpose has ended.
- Who
- Hollys customers whose information was in the file. The company reported about 2.76 million records, including duplicates.
- What
- An unauthorized access incident exposed an old temporary membership-data file.
- When
- Hollys said it confirmed the leak on October 16.
- Where
- A cloud service that used membership information.
- Why
- Not stated
This story does not have two clearly opposing sides.
The leaked file was believed to contain accumulated customer data from this period.
Hollys said it confirmed unauthorized access to a cloud service using membership information and discovered the leak.
Donga Ilbo published its report on the incident.
- Affected records
- About 2.76 million, including duplicate members
- Data period
- 2009 to February 11, 2020
- File type
- Temporary file created for a membership-service update
- Exposed information
- IDs, passwords, names, birth dates, phone numbers, addresses, email addresses and service-use information
What people are saying
Personal information must be protected not only in originals but also in copies and printouts.
If information has been collected, it must be protected thoroughly; when its purpose has been achieved or its useful life has ended, it should be destroyed.