Attackers used stolen credentials to access Chick-fil-A One accounts between June 17 and June 19, exposing names, partial card numbers, and rewards balances
Chick-fil-A notified customers that unauthorized parties accessed their Chick-fil-A One loyalty accounts in a credential stuffing attack that targeted the company's website and mobile app between June 17 and June 19, 2026. The company said it determined on July 13 that customer account information may have been compromised.
In credential stuffing attacks, bad actors deploy automated software to try login credentials — typically harvested from prior data breaches — against accounts on unrelated services. Chick-fil-A said the attackers used credentials obtained from a third-party source to break into accounts.
According to the company, the data that may have been viewed includes customers' names, email addresses, membership and mobile pay numbers tied to their Chick-fil-A One accounts, QR codes, stored credit balances, and the final four digits of any linked payment cards. Where customers had entered optional profile details, those records — including dates of birth, phone numbers, and home addresses — could also have been reached, the company said.
Chick-fil-A has not disclosed the total number of affected customers nationwide. Breach notifications filed with state attorneys general indicate at least 2,182 customers in Texas and 39 in Massachusetts were affected, according to BleepingComputer. The company also sent notifications to residents of Iowa, the District of Columbia, Maryland, New Mexico, New York, North Carolina, Oregon, Vermont, and Rhode Island.
"We recently identified a security incident that may have affected a limited number of Chick-fil-A One Loyalty accounts," a company spokesperson told Newsweek. "We sincerely apologize for any inconvenience or concern this situation may have caused and remain committed to maintaining the trust our guests place in us every day."
Chick-fil-A's remediation steps included signing all compromised users out of their accounts, stripping saved payment methods, making whole any drained account balances, and forcing password resets. The company also added rewards to affected accounts and said it is enhancing its security and monitoring controls. Customers are being urged to set a new, unique password for their Chick-fil-A accounts.
This is not the first time Chick-fil-A has faced this type of attack. A prior incident disclosed in 2023 revealed that attackers had broken into more than 71,000 Chick-fil-A accounts during a months-long campaign stretching from December 2022 into February 2023, according to BleepingComputer. That incident exposed similar categories of personal information, and the company responded with comparable account security measures at the time.
Join 500,000+ readers who start their day with Quartz.
By subscribing, you agree to our Terms of Service and Privacy Policy.
