Chick-fil-A Says Credential-Stuffing Attacks Exposed Data of 13,322 Customers
Summary
Chick-fil-A says credential-stuffing attacks on its website and app exposed data from 13,322 Chick-fil-A One customers. The company logged out affected users, removed payment methods, restored balances, and advised password changes.
Key points
- Chick-fil-A detected suspicious login activity targeting Chick-fil-A One accounts between June 17 and June 19.
- Attackers used automated tools and credentials obtained from third-party sources to access accounts.
- Exposed data included names, email addresses, membership numbers, account credit amounts, mobile pay numbers, and the last four digits of payment cards.
- Birth dates, phone numbers, and addresses may also have been accessed if stored in affected accounts.
- The company reported that 13,322 people were affected.
- Chick-fil-A logged out affected accounts, removed payment methods, restored balances, and advised customers to change passwords.
Article Details
- Victim Organization
- Chick-fil-A
- Incident Type
- Credential stuffing attacks compromised Chick-fil-A One accounts and exposed customer data.
- Data Types Exposed
- Names
- Email addresses
- Chick-fil-A One membership numbers
- Chick-fil-A credit balances
- Mobile pay numbers
- Last four digits of credit/debit card numbers
- Birth dates, phone numbers, and addresses (potentially, if stored in compromised accounts)
- Affected Records
- 13,322 people
- Operational Impact
- Chick-fil-A logged out impacted accounts, removed payment methods, restored affected account balances, added rewards to affected accounts, and advised customers to change passwords. The article reports no service disruption.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed