Chick-fil-A has disclosed a data breach after attackers used credential stuffing to access customer accounts. The company detected suspicious sign-in activity involving certain Chick-fil-A One accounts.
The attacks targeted the restaurant chain’s website and mobile app between June 17 and June 19, 2026. Chick-fil-A concluded on July 13 that unauthorised parties may have accessed customer account information.
The company has not revealed the total number of affected accounts. However, it reported that the incident affected 2,182 people in Texas.
Stolen Credentials Enabled Account Access
Credential stuffing attacks rely on username and password combinations stolen from another source. Criminals use automated tools to test those credentials across many websites and apps.
The tactic succeeds when customers reuse passwords. Once attackers gain entry, they can view personal details, payment information, rewards balances, and other data stored in the account.
Chick-fil-A said attackers used credentials obtained from a third party. The company did not say where the credentials originally came from.
Customer and Payment Details May Be Exposed
The Chick-fil-A data breach may have exposed several types of account information. This includes customer names, email addresses, membership numbers, and mobile payment numbers.
Attackers may also have accessed QR codes, reward-credit balances, and the last four digits of debit or credit cards. In some cases, accounts may have contained birth dates, phone numbers, and home addresses.
The company has sent notification letters to affected people in several US states and the District of Columbia. It has not confirmed the final number of customers impacted by the attack.
Company Resets Affected Accounts
Chick-fil-A logged out accounts affected by the incident. It also removed stored payment methods to reduce the chance of further unauthorised transactions.
In addition, the company restored affected rewards balances. It also added rewards to impacted accounts as an apology.
The company urged affected customers to change their passwords promptly. Users should also avoid reusing the same password across different services.
A password manager can help customers create unique passwords for every account. Enabling multi-factor authentication, where available, adds another layer of protection.
Previous Credential Stuffing Incident
This is not the first credential stuffing incident reported by the restaurant chain. In 2023, Chick-fil-A confirmed that attackers had accessed personal information and used stored rewards balances from more than 71,000 accounts.
That earlier activity took place between December 2022 and February 2023. The latest incident again shows how reused passwords can put customer accounts at risk.
Conclusion
The Chick-fil-A data breach highlights the ongoing threat from credential stuffing attacks. Customers should change reused passwords, monitor their payment activity, and review any rewards or account changes for suspicious activity.
0 responses to “Chick-fil-A Data Breach Follows Credential Stuffing Attacks”