Chick-fil-A Discloses Data Breach After Credential Stuffing Attacks

American fast-food restaurant chain Chick-fil-A is sending customers data breach notifications: a number of accounts were compromised during a recent wave of credential stuffing attacks. The company describes itself as the third-largest quick-service chain in the U.S. and operates more than 3,000 restaurants across the U.S., Canada, Puerto Rico, the U.K. and Singapore.

How the Attack Happened

Suspicious login activity on Chick-fil-A One accounts was spotted during internal monitoring. The investigation revealed that from June 17 to June 19, 2026, unknown actors ran an automated attack against the website and mobile app, using email-and-password combinations obtained from a third-party source. On July 13, the company determined that the attackers may have gained access to data in the affected accounts.

In credential stuffing, attackers use automated tools to run through already-stolen login-password pairs. The method is especially effective when people reuse the same credentials across different services.

What Was at Risk

The breach may have exposed names, email addresses, Chick-fil-A One membership numbers and mobile pay numbers, QR codes, reward balance amounts and the last four digits of a bank card number. If an account had a date of birth, phone number and address on file, those may also have been accessible to the attackers.

The company is not disclosing the total number of people affected, but its notification to the Texas Attorney General cites 2,182 state residents. Letters were also sent to residents of Iowa, the District of Columbia, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Vermont and Rhode Island.

The Company's Response

Chick-fil-A forcibly terminated sessions on all affected accounts, removed linked payment methods, restored reward balances and, by way of apology, credited additional rewards. Users are advised to change their passwords as soon as possible — since the breach occurred through credentials stolen elsewhere, the chain's own infrastructure was not directly compromised.

This is not the first such incident: in March 2023, Chick-fil-A confirmed that a similar wave of attacks running from December 2022 through February 2023 gave attackers access to the data and reward balances of more than 71,000 customers.

Source: Bleeping Computer