Hollys reported to KISA a leak of about 2.76 million personal-information records after unauthorized access to cloud storage holding temporary files for a membership-system overhaul. The data accumulated from 2009 through February 2020 and includes duplicate members, so the count does not mean 2.76 million individual victims. Exposed fields included IDs, passwords, names, contact details, addresses, and duplicate identification information (DI); the identified exposure period was September 3 through October 7. The company blocked the access route, is investigating possible intrusion for cryptocurrency mining, and recommended changing passwords on other services where the same password was used.