INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Hacker Leaks Passwords of Private Membership Service

| 2026-10-20 11:25 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
A coffee specialist shop, Hali's, experienced a data breach incident involving the personal information of its membership customers on October 16th. The breach occurred when an unauthorized access was not granted to its membership system between September 3rd and October 7th, affecting approximately 1,500 customers who joined since February 11th, 2020. The leaked items included user IDs, passwords, names, dates of birth, phone numbers, addresses, email addresses, duplicate registration confirmation information (DI), and other related services information. The breach was discovered when Hali's posted a notice on its official website regarding the data breach and subsequent guidance.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎February 11th, 2020
Threat actors leaked sensitive information, including passwords of a private membership service Hashi.
organisation Hashi
Customers were also instructed to change their Hashi membership passwords and to change the passwords of other services using the same ID and password.
‎February 11th
Threat actors leaked sensitive information, including passwords, of a private membership service since February 11th, 2020.
‎October 16th
Threat actors gained unauthorized access to Hali's membership system on October 16th.
tactic Data Breach
On October 16th, Hali's posted a notice on its official website regarding the data breach and its subsequent guidance.
‎September 3rd to October 7th
The hacker leaked sensitive information, including passwords, of a private membership service over an estimated period from September 3rd to October 7th.
‎2026/10/20
Threat actors leaked sensitive information, including passwords and duplicate registration confirmation data (DI), of a private membership service.
organisation DI
The breach also included the customer's address and duplicate registration confirmation information (DI).
Intelligence Sources
Dailysecu 2026-10-20