Chick-fil-A is warning customers after a security incident allowed unauthorized parties to access certain Chick-fil-A One loyalty accounts. The breach, which occurred between June 17 and June 19, 2026, was the result of a credential stuffing attack where attackers used email addresses and passwords obtained from third-party sources.
These stolen credentials were then tested against Chick-fil-A One accounts. When customers had reused passwords from other sites where data had been compromised, the attackers were able to gain access. While Chick-fil-A has not disclosed the total number of affected customers, public filings indicate that thousands of residents across multiple states were impacted.
Exposed Information
The data exposed varied by account but may have included customer names, email addresses, Chick-fil-A One membership numbers, mobile pay numbers, account QR codes, the amount of Chick-fil-A credit stored in an account, the last four digits of linked payment cards, phone numbers, and saved addresses. Notably, full payment card numbers, Social Security numbers, and bank account details were not reported as exposed.
Chick-fil-A has stated that it logged affected customers out of their accounts, removed saved payment methods, and added rewards to their accounts to mitigate the impact. The company has not yet publicly addressed whether any exposed QR codes were utilized by the attackers.
Understanding Credential Stuffing
Credential stuffing is a cyberattack method where attackers use lists of usernames and passwords stolen from previous data breaches to attempt logins on other websites and services. The effectiveness of this method relies heavily on password reuse by individuals across different platforms. In this incident, the login details used by attackers were sourced externally.
This marks Chick-fil-A's second significant credential stuffing incident. In March 2023, the company reported that attackers accessed over 71,000 customer accounts in a campaign that ran from December 2022 to February 2023.
Recommendations for Customers
Chick-fil-A advises customers to change their Chick-fil-A One passwords and to update passwords on any other accounts where the same login combination was used. It is recommended to use unique passwords for each online account and consider using a password manager. Customers are also encouraged to review their Chick-fil-A transaction history and rewards activity for any unrecognized changes and to verify that saved payment methods have been removed if they received a breach notification.
Furthermore, customers should remain vigilant for phishing scams that may use the exposed information to create convincing fraudulent communications. It is advised to avoid clicking on links in suspicious emails or texts and to access the official Chick-fil-A app or website directly. The company also recommends enabling multifactor authentication on other sensitive accounts, such as email and financial services, where available, and maintaining updated antivirus protection on all devices.