Chick-fil-A loyalty accounts compromised by credential stuffing

Chick-fil-A is notifying customers that their loyalty program accounts were compromised in an automated cyberattack in June, potentially exposing personal information. The fast-food chain said the incident was a credential-stuffing attack that targeted its website and mobile application between June 17 and June 19, 2026.

The company stated that unauthorized parties used email and password combinations obtained from a third-party source, likely from previous data breaches on other platforms, to gain access to Chick-fil-A One accounts. On July 13, the company concluded its investigation and determined that the attackers may have accessed information within those accounts.

Information exposed could include a customer's name, email address, Chick-fil-A One membership number, mobile pay number, QR code, account balance, and the last four digits of a linked credit or debit card. For customers who had provided additional details, the attackers may also have accessed birth dates, phone numbers, and physical addresses.

In response, Chick-fil-A logged users out of affected accounts, removed stored payment methods, and restored any altered account balances. The company also provided...