One-minute news
Hollys, a coffee franchise, notified customers by text message that customer data had been exposed after unauthorized access to its membership system. Hollys confirmed the breach on October 16. It believes the incident occurred between September 3 and October 7—a period of 35 days.
The exposed information includes membership IDs and passwords, names, dates of birth, phone numbers, addresses, email addresses, and duplicate-subscriber verification information (DI). The affected customers are those who joined the Hollys membership program before February 11, 2020. The number of people affected has not yet been determined.
Hollys says it has blocked the unauthorized access route, strengthened its authentication procedures, increased monitoring for suspicious login attempts, and reported the incident to the relevant authorities.
Membership information belonging to Hollys customers has been stolen in a hacking incident.
On October 18, Hollys notified customers by text message that personal information had been exposed after unauthorized external access to its membership system. The company confirmed the breach on October 16. It believes the incident took place between September 3 and October 7.
The exposed information includes membership IDs and passwords, names, dates of birth, phone numbers, addresses, email addresses, and duplicate-subscriber verification information (DI). The affected customers are those who joined the Hollys membership program before February 11, 2020.
Hollys has not explained why that date was used as the cutoff. It also said that the number of people affected and the scale of the breach have yet to be determined.
The problem is that passwords were exposed
Passwords are the most concerning item among the information exposed. Hollys urged customers to change the passwords for any other services where they use the same ID and password.
People often reuse the same ID and password across multiple websites. Hackers can automatically try stolen combinations of IDs and passwords on other sites—a technique known as “credential stuffing.” If customers also used their Hollys password for banking, shopping, or email accounts, those accounts could be compromised as well. However, if the passwords were exposed in hashed form, that would not necessarily allow immediate access to other accounts.
Duplicate-subscriber verification information (DI) is an identifier generated for each website during identity verification. It is used to confirm that someone is the same person across services, instead of using a resident registration number. DI does not itself reveal a person’s resident registration number, but when combined with a name, date of birth, and phone number, it could be used to impersonate someone on other services. Since addresses and phone numbers were also exposed, the information could be used in text-message scams impersonating delivery companies or financial institutions.
What Hollys has done—and what customers should do
Hollys says it has blocked the unauthorized access route and strengthened its authentication procedures. It has increased monitoring for abnormal login attempts and reported the incident to the relevant authorities, with which it is cooperating in the investigation. The company apologized for the concern caused and said it would do its utmost to protect customer information and minimize harm.
Customers should take action now: change their Hollys membership password; change passwords on other sites if they reused the same ID and password; and avoid opening links in text messages or emails claiming to be from Hollys or a financial institution. It is safer to use a different password for each site and, where available, enable two-factor authentication, which requires an additional confirmation by text message or app.
SK Telecom and Coupang among this year’s breaches; fines can reach 3% of revenue
Personal information breaches have been unusually frequent this year. SK Telecom was fined 134.8 billion won over the exposure of SIM-card information. Coupang was fined a record 624.7 billion won in June after information belonging to 37.5 million people was exposed.
The Personal Information Protection Act allows fines of up to 3% of a company’s total revenue for violating its security obligations.
The law requires companies to report a breach to the Personal Information Protection Commission or the Korea Internet & Security Agency (KISA) within 72 hours of discovering it, and to notify users. Hollys confirmed the breach on October 16 and notified customers on October 18. The exposure reportedly began in early September, but was not discovered until mid-October. The Personal Information Protection Commission’s investigation will determine why the intrusion went undetected for more than a month, whether the passwords were encrypted, and how many people were affected.