Chick-fil-A Discloses Data Breach After Credential-Stuffing Attacks
Summary
Chick-fil-A says attackers used stolen credentials to target its website and app in June 2026. The company determined they may have accessed Chick-fil-A One account information and took steps to secure affected accounts.
Key points
- Chick-fil-A said automated credential-stuffing attacks targeted its website and mobile app from June 17 to June 19, 2026, using credentials obtained from a third party.
- The company said unauthorized parties may have accessed information in affected Chick-fil-A One accounts.
- Potentially exposed data included names, email addresses, membership numbers, mobile pay numbers, QR codes, account credit balances, and the last four digits of payment cards; some accounts may also have held birth dates, phone numbers, and addresses.
- Chick-fil-A told the Texas Attorney General the breach affected 2,182 Texans; the total number of affected customers was not disclosed.
- The company logged out affected accounts, removed payment methods, restored account balances, added rewards, and advised customers to change passwords.
Article Details
- Victim Organization
- Chick-fil-A
- Incident Type
- Credential-stuffing attack resulting in unauthorized access to Chick-fil-A One accounts and a data breach.
- Incident Date
- 2026-06-17
- Data Types Exposed
- Names
- Email addresses
- Chick-fil-A One membership numbers
- Mobile pay numbers
- QR codes
- Chick-fil-A account credit balances
- Last four digits of credit or debit card numbers
- Birth dates, phone numbers, and addresses, if stored in compromised accounts
- Affected Records
- The total number of affected customers was not disclosed. Chick-fil-A reported to the Texas Attorney General that 2,182 Texans were affected.
- Operational Impact
- Impacted accounts were logged out, payment methods were removed, account balances were restored, and rewards were added to affected accounts. Chick-fil-A advised affected users to change their passwords.
- Claim Status
- confirmed