Chick-fil-A says attackers broke into some customer loyalty accounts after using stolen passwords from other sources, exposing personal and account data. The automated credential-stuffing attacks targeted the Chick-fil-A website and mobile app between June 17 and June 19, 2026 and affected Chick-fil-A One accounts. Exposed data can include names, email addresses, membership numbers, mobile pay numbers, QR codes, reward balances, card last four digits, and in some cases birth dates, phone numbers, and addresses.
Why it matters: Affected customers could face account takeover, fraud involving stored balances, and follow-on phishing or identity misuse. Users should reset reused passwords and review linked payment and loyalty accounts, while defenders should watch for credential-stuffing activity and strengthen login protections.
Sergiu Gatlan
2026.07.24
98% relevant
This source updates the same June 17-19, 2026 Chick-fil-A One credential-stuffing incident with a confirmed total of 13,322 affected people and more precise details on the data accessed, including names, emails, loyalty numbers, balances, mobile pay numbers, card last four digits, and in some cases birth dates, phone numbers, and addresses.
Eduard Kovacs
2026.07.23
99% relevant
This article is the same underlying event and adds specifics on the attack window (June 17-19), the affected platform (Chick-fil-A One mobile app and website), the types of data exposed, and Chick-fil-A’s response including forced logouts, password resets, payment-method removal, and restored balances.
Sergiu Gatlan
2026.07.22
100% relevant
This article appears to be the first tracked item here for the June 2026 Chick-fil-A credential-stuffing breach affecting Chick-fil-A One accounts.
← Back to all stories