Chick-fil-A Says Credential-Stuffing Attack Targeted Rewards Accounts
Summary
Chick-fil-A says credential-stuffing attacks on its One loyalty accounts on June 17–19 may have exposed customer data. The number affected is unclear; the company reset passwords, removed saved payment methods, and restored drained balances.
Key points
- Attackers used credentials from third-party sources to target Chick-fil-A One accounts through the mobile app and website on June 17–19.
- Chick-fil-A determined on July 13 that attackers may have obtained data from compromised accounts.
- Potentially exposed data included names, email addresses, membership and mobile pay numbers, partial payment card numbers, account balances, and, in some cases, phone numbers, addresses, and dates of birth.
- The company logged out affected accounts, reset passwords, and removed stored payment methods.
- Chick-fil-A says it restored balances drained from accounts and added rewards.
- The number of affected people is unclear; state attorney general submissions suggest thousands or tens of thousands may be affected.
Article Details
- Victim Organization
- Chick-fil-A
- Incident Type
- Credential stuffing attack resulting in a data breach targeting customer accounts
- Data Types Exposed
- Names
- Email addresses
- Chick-fil-A membership numbers
- Mobile pay numbers
- Partial payment card numbers
- Account balances
- Phone numbers
- Addresses
- Dates of birth
- Affected Records
- Thousands or tens of thousands may be affected, based on numbers submitted to the attorneys general in Texas and Massachusetts; the exact number is unclear.
- Operational Impact
- Affected accounts were logged out, passwords reset, and stored payment methods removed. Balances drained from accounts were restored, and additional rewards were added. The company determined on July 13 that attackers may have obtained data stored in compromised accounts.
- Claim Status
- confirmed