Summary (tl;dr)

Chick-fil-A is notifying customers of a recent data breach affecting its Chick-fil-A One loyalty accounts, where unauthorized parties accessed personal and payment information through credential stuffing attacks on the company's website and mobile app.

Essential Background

Chick-fil-A is a prominent American fast-food restaurant chain, operating over 3,000 locations across the U.S. and beyond, and is known for its popular Chick-fil-A One loyalty program. Data breaches are a common cyber threat where unauthorized individuals gain access to sensitive, protected, or confidential data. Credential stuffing, a type of cyberattack, involves using stolen username and password combinations from other breaches to gain unauthorized access to accounts on different platforms, exploiting the common practice of password reuse.

The Full Story

Between June 17 and June 19, 2026, Chick-fil-A's website and mobile application were targeted by an automated "credential stuffing" attack. The attackers utilized account credentials (email addresses and passwords) that were obtained from a third-party source. On July 13, 2026, the company determined that these unauthorized parties may have accessed information within affected Chick-fil-A One accounts. The compromised data could include customers' names, email addresses, Chick-fil-A One membership numbers, mobile pay numbers and QR codes, the last four digits of their credit/debit card numbers, and Chick-fil-A credit balances. If stored in the accounts, birth dates, phone numbers, and addresses may also have been accessed. Chick-fil-A has since taken steps to secure accounts, including resetting passwords for affected users, restoring impacted loyalty balances, and adding rewards as an apology. The company has issued data breach notification letters to residents in numerous states, including Texas, Massachusetts, Iowa, Maryland, New Mexico, New York, North Carolina, Oregon, Rhode Island, Vermont, and Washington D.C.

Why It Matters

This data breach is significant because it exposes sensitive personal and financial information, potentially leading to identity theft and fraudulent activity for affected customers. Cybercriminals can use stolen credentials for various malicious purposes, including making unauthorized purchases or accessing other online accounts where customers have reused passwords. For Chick-fil-A, such incidents can erode customer trust and damage the company's reputation, underscoring the critical need for robust cybersecurity measures. Customers are advised to change their Chick-fil-A account passwords, use strong and unique passwords for all online services, and monitor their financial accounts and credit reports for any suspicious activity.

Geographic Location

• Virtual/Online (cyberattack targeting Chick-fil-A's website and mobile application)
• Atlanta, Fulton County, Georgia, United States (company headquarters)