Chick-fil-A Discloses Data Breach After Credential Stuffing Attacks

Loyalty Accounts Compromised in Automated Attack

American fast-food chain Chick-fil-A is sending breach notification letters to customers following a wave of credential stuffing attacks that targeted the company's website and mobile app in June 2026. The attacks successfully compromised Chick-fil-A One loyalty program accounts, exposing customer personal data and payment information.

Breach notification letters were dated July 20, 2026, with the company's internal investigation concluding on July 13, 2026.

Attack Timeline

The attack window was narrow — just three days — but credential stuffing attacks can compromise large numbers of accounts in hours when attackers use large lists of previously breached username/password pairs and automated tooling.

What Is Credential Stuffing?

Credential stuffing is an automated account takeover technique in which attackers take username/password combinations leaked from previous data breaches and test them against other platforms en masse. Because many people reuse passwords across sites, these attacks can be highly effective even without breaching the target organization's systems directly.

Attack Flow:
1. Attacker acquires leaked credential database (prior breach, darknet purchase)
2. Automated tools test each credential pair against Chick-fil-A login endpoints
3. Valid combinations → successful account access
4. Attacker harvests loyalty balances, PII, and payment data from compromised accounts
5. Accounts may be sold or used for gift card fraud

Chick-fil-A's systems were not directly breached — the credentials came from third-party data breaches, not from Chick-fil-A itself.

Data Exposed

For all accounts confirmed as compromised, the following data was exposed:

For customers who had optional profile information filled in, additional data may have been accessible:

• Date of birth
• Phone number
• Physical address

Scale and Geographic Reach

Chick-fil-A has not released a total count of affected customers. State attorney general filings reveal:

• Texas: at least 2,182 customers notified
• Massachusetts: at least 39 customers notified
• Additional notifications sent to customers in: Iowa, Washington D.C., Maryland, New Mexico, New York, North Carolina, Oregon, Vermont, and Rhode Island

Notifications have gone to at least 10 states plus D.C. — suggesting the attack had a broad geographic footprint, though the total number of compromised accounts has not been confirmed.

Chick-fil-A's Response

The company took the following steps after detecting the attacks:

• Forced logout of all compromised accounts
• Removed stored payment methods from affected accounts
• Reset passwords on compromised accounts
• Filed breach notifications with multiple state attorneys general
• Sent individual notification letters to affected customers

A Repeat Pattern

This is not Chick-fil-A's first credential stuffing incident. In March 2023, the company disclosed a similar attack that ran from December 2022 through February 2023 and compromised over 71,000 Chick-fil-A One accounts.

The recurrence raises questions about the effectiveness of the controls implemented after the 2023 incident. Effective defenses against credential stuffing typically require a layered approach beyond simple detection and response.

Protective Measures for Affected Customers

If you have a Chick-fil-A One account, take these steps:

1. Change your Chick-fil-A password if you haven't already — use a unique, strong password
2. Check if that password is used elsewhere — if so, change it on every site immediately
3. Review your Chick-fil-A credit balance for unauthorized redemptions
4. Monitor your payment card linked to the account for suspicious charges
5. Enable any available MFA on your Chick-fil-A One account
6. Use a password manager to generate and store unique credentials for each service

What Organizations Can Learn

Credential stuffing is a highly scalable, low-effort attack. Defending against it requires more than detecting anomalous logins after the fact:

The 2023 Chick-fil-A incident and this 2026 recurrence illustrate that credential stuffing defenses need to be continuously evaluated — attacker tooling evolves, and controls that blocked attacks in a prior year may not be sufficient against updated techniques.

References

• BleepingComputer — Chick-fil-A discloses data breach after credential stuffing attacks
• Malwarebytes — Chick-fil-A loyalty accounts hijacked using stolen passwords
• Forbes — Chick-fil-A Sends Data Breach Notifications After Password Attacks

Related Reading

• Upbound Hack Caused $13M in Fraudulent Acima Leases
• UK Online Safety Act and AI Chatbots