Global

Chick-fil-A Loyalty Account Breach Exposes Customer Data in Credential-Stuffing Attack

A chick fil a loyalty account breach allowed unauthorized parties to access customer personal information across multiple states.

Asude Karataş • 22 Temmuz 2026 21:00 • 4 dk okuma • 31 görüntülenme

Chick-fil-A discovered a security incident affecting its One Loyalty program after hackers used stolen usernames and passwords to gain unauthorized access to customer accounts in 10 states. The fast-food chain identified suspicious login activity on certain accounts and launched an investigation that revealed attackers had conducted a credential-stuffing attack between mid-June and mid-July. The company has since notified affected customers and implemented security measures including forced logouts and restoration of account balances.

İçindekiler ›

How the Attack Unfolded
What Customer Information Was Exposed
Company Response and Customer Protection Measures

How the Attack Unfolded

Between June 17 and June 19, unauthorized parties leveraged account credentials obtained from a third-party source to conduct an automated credential-stuffing campaign against Chick-fil-A's website and mobile application. The attackers used these stolen usernames and passwords in a systematic attempt to gain access to customer accounts. Chick-fil-A confirmed on July 13 that the breach may have resulted in unauthorized access to affected accounts, leading the company to notify customers in the District of Columbia, Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, and Vermont.

What Customer Information Was Exposed

The compromised data included customers' names, email addresses, Chick-fil-A One membership numbers, Mobile Pay numbers, QR codes, and the last four digits of payment card numbers. Additionally, account gift card balances were accessible to attackers. For customers who had stored additional information within their loyalty accounts, the breach also exposed month and day of birth, phone numbers, and addresses. However, full payment card numbers and CVV codes were not compromised, limiting the immediate financial exposure for affected customers.

Company Response and Customer Protection Measures

Upon discovering the incident, Chick-fil-A took immediate action to secure affected accounts. The company forced logouts on all impacted accounts, removed any stored payment methods, and restored One Loyalty program balances. As compensation for the inconvenience and security concern, Chick-fil-A added rewards credits to affected customer accounts. The company also stated it continues to enhance its security monitoring and fraud controls to prevent similar incidents in the future.

Chick-fil-A has recommended that customers reset their account passwords immediately using strong, unique credentials not used on other websites. The company also encourages customers to review their account activity, bank statements, credit card statements, and credit reports for any suspicious transactions or unauthorized access.

What is credential stuffing and how does it work?+

Credential stuffing is an automated cyberattack method where hackers use lists of compromised usernames and passwords (typically from previous data breaches) to attempt unauthorized access to accounts on other platforms. Because many users reuse passwords across multiple websites, attackers can gain entry to accounts even without knowing the original passwords. Once inside, they can access personal information, make unauthorized transactions, or establish a foothold for further attacks.

How many customers were affected by the chick fil a loyalty account breach?+

Chick-fil-A has not disclosed the specific number of affected customers. The company has stated that a "limited number" of One Loyalty accounts were impacted, but the exact figure has not been publicly released. Notifications were sent to customers in 10 states and the District of Columbia.

Were full credit card numbers exposed in the chick fil a loyalty account breach?+

No. Attackers only accessed the last four digits of payment card numbers stored in customer accounts. Full credit card numbers, expiration dates, and CVV security codes were not compromised, significantly limiting the financial fraud risk for affected customers.

What should I do if I have a Chick-fil-A loyalty account?+

Chick-fil-A recommends resetting your password immediately with a strong, unique password not used on other accounts. Monitor your email for official notifications from the company. Review your bank and credit card statements regularly for any unauthorized charges, and consider checking your credit report with major credit bureaus. If you notice suspicious activity, contact your financial institution and file a report with the Federal Trade Commission if necessary.

How did Chick-fil-A compensate affected customers?+

Chick-fil-A added rewards credits to the accounts of all affected customers as compensation for the security incident and resulting inconvenience. The company also restored any One Loyalty program balances that were accessible during the attack and removed stored payment methods from accounts to prevent further unauthorized use.

Paylaş: