Chick-fil-A is notifying customers that cybercriminals gained unauthorized access to some Chick-fil-A One loyalty accounts after a credential stuffing attack carried out last month. The company says attackers used login credentials obtained elsewhere to break into accounts on its website and mobile app, exposing personal information and, in some cases, stored payment details.
What happened and when
According to a notice filed with regulators, Chick-fil-A determined that unauthorized parties launched an automated attack against its website and app between June 17 and June 19, 2026, using account credentials such as email addresses and passwords obtained from a third-party source. The company says it detected suspicious login activity, moved to stop further unauthorized access, and opened an investigation. On July 13, 2026, that investigation confirmed attackers may have accessed information stored in affected Chick-fil-A One accounts. buy vpn
Depending on what individual customers had saved, exposed data may include names, email addresses, membership numbers, mobile pay numbers, QR codes, rewards balances, Chick-fil-A credit, and the last four digits of linked payment cards. Where available, phone numbers, birth dates, and mailing addresses may also have been viewed. Chick-fil-A has not disclosed a total number of affected customers, though a filing with the Texas Attorney General puts the figure at 2,182 residents in that state alone. Notification letters have also gone out to residents of Iowa, Maryland, Massachusetts, the District of Columbia, New Mexico, New York, North Carolina, Oregon, Rhode Island, and Vermont, suggesting the true scope is considerably larger nationwide.
Why credential stuffing keeps working
Chick-fil-A is careful to note that its own systems were not breached and that passwords were not stolen from the company directly. Instead, attackers relied on credentials leaked in unrelated data breaches and simply tested them against Chick-fil-A accounts. This is credential stuffing: an automated technique that exploits the widespread habit of reusing the same email and password across multiple services. When one site is compromised, every other account sharing that password becomes vulnerable, regardless of how secure the second company's own defenses are.
Loyalty programs are attractive targets precisely because they are often treated as low-stakes accounts, even though they frequently store saved payment methods, redeemable balances, and personal details. That combination lets criminals commit fraud, drain rewards, or harvest information for later phishing campaigns, all without ever touching a bank account directly. This is not an isolated incident for the company either; in 2023, Chick-fil-A disclosed a similar credential stuffing campaign that compromised more than 71,000 accounts and allowed attackers to spend stored rewards.
What the company has done, and what customers should do
In response, Chick-fil-A says it has logged affected users out of their accounts, removed stored payment methods, restored compromised rewards balances, issued bonus rewards to affected customers, and advised them to reset their passwords. Those measures address the immediate damage, but they do not eliminate the underlying risk for anyone who still reuses passwords across services.
- Change your Chick-fil-A password immediately, even without a notification, and update it anywhere else it was reused.
- Use a unique password for every account, ideally generated and stored through a password manager.
- Enable multi-factor authentication wherever it is offered.
- Review your account for unfamiliar orders, profile changes, or missing rewards.
- Check bank and card statements for unrecognized transactions.
- Watch for follow-up phishing messages claiming to offer compensation for the breach.
The longer-term lesson
Credential stuffing attacks rarely begin at the company that ultimately gets breached. The stolen logins usually trace back to earlier, unrelated incidents that surface publicly months or years later. Services that continuously monitor whether your email addresses and passwords have appeared in known breaches can give an early warning before attackers reuse that data elsewhere. Paired with unique passwords and multi-factor authentication, that kind of monitoring is one of the few practical defenses against an attack method that depends entirely on old habits rather than new vulnerabilities.
