Chick-fil-A Data Breach: Credential Stuffing Compromises Customer Accounts

Chick-fil-A reported a data breach affecting its Chick-fil-A One loyalty accounts due to credential stuffing attacks that occurred between June 17 and June 19, 2026. The attackers used stolen usernames and passwords acquired from a third-party source to access customer accounts. The company detected suspicious login activity and confirmed on July 13 that unauthorized parties may have accessed customer data. Potentially exposed information includes names, email addresses, membership numbers, mobile pay details, QR codes, and the last four digits of credit/debit card numbers. Customers in 10 states, including Texas and Massachusetts, were notified of the breach. Chick-fil-A has since forced log-outs, removed payment methods, restored account balances, and added rewards for affected customers. The incident highlights the risks associated with credential reuse and the importance of multi-factor authentication.

Key Points: • Chick-fil-A's loyalty accounts were compromised through credential stuffing attacks. • The breach potentially exposed personal information of customers in 10 states. • Chick-fil-A took immediate action by securing accounts and restoring balances.