Thousands of Chick-fil-A One loyalty accounts were accessed without authorization after criminals ran stolen login credentials against the company's website and mobile app, the restaurant chain has confirmed. The intrusion took place between June 17 and June 19, 2026, and Chick-fil-A determined on July 13 that unauthorized parties may have viewed customer information stored in affected accounts.
How the attack unfolded
According to the notice filed with regulators, the breach did not originate inside Chick-fil-A's own systems. Instead, attackers used email addresses and passwords obtained from an unrelated third-party source and tested them against Chick-fil-A One accounts in an automated, large-scale attempt. This method, known as credential stuffing, relies on the widespread habit of reusing the same password across multiple websites. When one service is breached, the exposed credentials often get recycled against dozens of other platforms, from banking apps to loyalty programs, until a match is found. buy vpn
Depending on what a customer had saved, exposed data may have included names, email addresses, membership numbers, mobile pay numbers, QR codes, rewards balances, Chick-fil-A credit, and the last four digits of linked payment cards. In some cases, phone numbers, birth dates, and mailing addresses were also accessible. Chick-fil-A has stated clearly that customer passwords were not obtained from its own infrastructure.
Scale and response
Chick-fil-A has not disclosed a nationwide total, but a filing with the Texas Attorney General puts the number of affected Texas residents at 2,182. Notification letters have also gone out to residents in Iowa, Maryland, Massachusetts, the District of Columbia, New Mexico, New York, North Carolina, Oregon, Rhode Island, and Vermont, suggesting the true scope extends well beyond any single state.
In response, the company says it has logged affected users out of their accounts, removed stored payment methods, restored rewards balances taken by attackers, added bonus rewards for affected customers, and advised everyone impacted to reset their passwords. This is not the chain's first encounter with this kind of intrusion: in 2023, Chick-fil-A disclosed that more than 71,000 accounts had been compromised in a similar credential stuffing campaign, with stolen rewards balances among the consequences.
Why loyalty accounts are a target
Restaurant reward programs might seem like low-value targets compared with financial institutions, but they frequently hold saved payment details, personal information, and digital wallet data that criminals can exploit before an owner notices anything wrong. Even without full card numbers, attackers can drain reward balances, place fraudulent orders, or harvest personal details to combine with data from other breaches, building more complete profiles for future phishing or identity fraud attempts.
Reducing your exposure
- Change your Chick-fil-A account password immediately, even without a notification.
- Update that same password anywhere else you may have reused it.
- Use a unique, strong password for every account, ideally generated and stored with a password manager.
- Turn on multi-factor authentication wherever it is offered.
- Check your Chick-fil-A account for unfamiliar orders, profile changes, or missing rewards.
- Review bank and card statements for unauthorized charges.
- Watch for phishing messages posing as Chick-fil-A communications or compensation offers.
Credential stuffing attacks succeed because stolen login data often circulates quietly for months before being weaponized elsewhere. Monitoring services that alert users when their email addresses or passwords surface in known breaches can help close that gap, giving people a chance to change credentials before old leaks are turned into new account takeovers. Combined with unique passwords and multi-factor authentication, that kind of early warning remains one of the most effective defenses against an attack method that shows no sign of disappearing.
