Chick-fil-A Confirms Data Breach After Credential Stuffing Attack Exposes Customer Personal and Payment Data

Chick-fil-A has confirmed a data breach affecting an undisclosed number of Chick-fil-A One loyalty accounts. This breach occurred as threat actors executed credential-stuffing attacks on its website and mobile application.

The incident underscores the ongoing risk associated with password reuse, where usernames and passwords exposed in unrelated third-party breaches are automatically tested against consumer platforms.

Chick-fil-A Confirms Data Breach

According to breach notifications, unauthorized activity took place between June 17 and June 19, 2026. Attackers used credentials obtained externally rather than compromising Chick-fil-A’s own password database, and they attempted automated logins on a large scale to identify customers who had reused the same credentials.

Chick-fil-A determined on July 13 that customer information in the accessed accounts may have been exposed.

The potentially exposed data includes customers’ names, email addresses, Chick-fil-A One membership numbers, Mobile Pay numbers, account QR codes, remaining Chick-fil-A credit or gift card balances, and the last four digits of linked credit or debit cards.

For users who had added optional profile information, the breach may also have exposed dates of birth, phone numbers, and residential addresses.

While the exposure of only the last four digits of payment cards limits the risk of direct card-not-present fraud from the breach alone, the combination of account identifiers, QR codes, loyalty balances, contact information, and partial payment data creates significant risks for account takeover and social engineering.

Criminals could use this information to impersonate customers, target them with convincing phishing emails or SMS messages, or attempt fraudulent redemption of stored loyalty rewards and payment balances.

Chick-fil-A has not publicly disclosed the total number of affected accounts, but regulatory notifications indicate that at least 2,182 Texas residents and 39 Massachusetts residents were impacted.

Notifications were also sent to consumers in the District of Columbia, Iowa, Maryland, New Mexico, New York, North Carolina, Oregon, Rhode Island, and Vermont.

In response to the breach, Chick-fil-A terminated active sessions for affected accounts, reset passwords, removed saved payment methods, and restored compromised balances where applicable.

These measures are intended to cut off persistent attacker access and limit the misuse of stored value within affected Chick-fil-A One accounts.

Credential stuffing is different from traditional network intrusions because attackers rely on valid, but reused, credentials. Organizations operating high-volume consumer login portals should treat automated authentication abuses as a critical fraud and identity security issue.

Implementing measures such as rate limits, bot detection, device and behavioral analytics, breached-password screening, anomalous login monitoring, and phishing-resistant multi-factor authentication is advisable.

Affected users should reset their Chick-fil-A passwords immediately, ensuring that they are unique and randomly generated. They should also review account balances, order history, linked payment methods, and login notifications.

Additionally, users are advised to monitor their email and SMS messages for impersonation attempts and to change any reused passwords elsewhere. This incident highlights that loyalty platforms have become high-value targets, as they combine personal data, payment tokens, QR-based access, and easily monetized stored rewards.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.