Back Ajc

Chick-fil-A data breach exposes personal information from loyalty accounts

Ajc • July 23, 2026

Some Chick-fil-A accounts were hacked last month, exposing the personal information of an undisclosed number of customers, the company said this week.

The data potentially accessed in the hack included customers’ names, email addresses, last four digits of stored credit/debit cards, month and day of their birthdays, phone numbers and addresses, according to a letter sent to the Massachusetts attorney general dated Monday.

A Chick-fil-A spokesperson said the security incident affected “a limited number” of Chick-fil-A One accounts, according to a statement provided to The Atlanta Journal-Constitution. Chick-fil-A One is the company’s loyalty program, which launched in 2016 .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chick-fil-A Data Breach: Credential Stuffing Compromises Customer Accounts Chick-fil-A reported a data breach affecting its Chick-fil-A One loyalty accounts due to credential stuffing attacks that occurred between June 17 and June 19, 2026. The attackers used stolen usernames and passwords acquired from a third-party source to access customer accounts. The company detected suspicious login activity and confirmed on July 13 that unauthorized parties may have accessed customer data. Potentially exposed information includes names, email addresses, membership numbers, mobile pay details, QR codes, and the last four digits of credit/debit card numbers. Customers in 10 states, including Texas and Massachusetts, were notified of the breach. Chick-fil-A has since forced log-outs, removed payment methods, restored account balances, and added rewards for affected customers. The incident highlights the risks associated with credential reuse and the importance of multi-factor authentication. 13 sources 58

Chick-fil-A data breach exposes personal information from loyalty accounts

The full story

Extracted Entities

Attack Types (1)

Companies (1)