Chick-fil-A Data Breach Exposes Customer Accounts in Credential Stuffing Attack

Chick-fil-A has reported a data breach affecting customer accounts due to credential stuffing attacks that occurred between June 17 and June 19, 2026. The attackers accessed accounts using stolen credentials obtained from a third-party source. The compromised data includes names, email addresses, membership numbers, mobile payment details, and the last four digits of credit/debit card numbers. Affected customers were notified, and the company has taken steps to secure accounts by logging out users, removing payment methods, and restoring account balances. The breach has impacted at least 2,182 customers in Texas and others across several states including Massachusetts and Maryland. Chick-fil-A has advised customers to change their passwords and monitor their accounts for suspicious activity.

Key Points: • Chick-fil-A experienced a data breach due to credential stuffing attacks. • Compromised data includes names, email addresses, and payment details. • At least 2,182 customers in Texas were affected, with notifications sent to others across multiple states.