Chick-fil-A customer accounts hit in June credential-stuffing wave

Key points

• Chick-fil-A says attackers ran an automated login attack against its website and mobile app between June 17 and June 19, 2026.
• The company confirmed on July 13, 2026 that customer account data may have been accessed.
• 2,182 Texas residents are affected, with notification letters also sent to customers in ten other US states and territories.
• Exposed data includes names, emails, membership numbers, QR codes, stored credit balances, and the last four digits of payment cards.
• This is the second credential-stuffing incident to hit Chick-fil-A One accounts, following a larger attack disclosed in March 2023.

Chick-fil-A is writing to customers to say their accounts were broken into over a three-day stretch in June, after criminals ran passwords stolen from other websites against the chain's login page.

The attack ran from June 17 to June 19, 2026. Suspicious login activity triggered an investigation, and on July 13, 2026 the company confirmed some Chick-fil-A One accounts had been accessed. Chick-fil-A One is the chain's loyalty and mobile ordering programme.

The technique is credential stuffing. Criminals take giant lists of email addresses and passwords leaked from other breaches and feed them into a login page using automated tools to see which ones still work. It pays off because so many people reuse the same password across different sites.

What did the hackers actually see?

They saw the sort of details a customer stores in a fast-food loyalty account: names, email addresses, Chick-fil-A One membership numbers, mobile pay numbers, QR codes, stored credit balances, and the last four digits of any saved card. Birth dates, phone numbers, and addresses may have been exposed too, if stored on the account.

Full card numbers were not among the exposed fields.

The company hasn't published a total headcount for affected customers. It told the Texas Attorney General that 2,182 Texans were hit. Notification letters have also gone to residents of Iowa, the District of Columbia, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, and Vermont, as first reported by BleepingComputer.

Chick-fil-A operates more than 3,000 restaurants across the United States, Canada, Puerto Rico, the United Kingdom, and Singapore.

What has the company done about it?

Every affected account was logged out, saved payment methods were stripped from them, and any stolen loyalty balances were restored. Bonus rewards were added as an apology. Customers are being told to pick a new password and to make sure it isn't one they use anywhere else.

From a threat intelligence angle, this isn't espionage. There's no named group, no novel malware, no zero-day (a previously unknown software flaw). It's opportunistic account takeover, the same low-effort, high-volume tactic that has hit fast-food apps, coffee chains, and airline loyalty programmes for years. Capability required: minimal. Intent: straightforward theft, draining loyalty balances, reselling accounts, or folding fresh data into the next stolen credential list.

It's also the second time Chick-fil-A has walked customers through this exact story. In March 2023 the chain confirmed a similar wave of attacks between December 2022 and February 2023 that hit more than 71,000 accounts and drained stored rewards. Worth keeping in mind alongside the 23andMe settlement we covered on 16 July: state attorneys general are increasingly willing to penalise companies whose defences couldn't stop basic, well-understood attacks.

What should customers do now?

Change your Chick-fil-A One password and change it on any other site where you reused it. Turn on any extra login checks the app offers. Watch your card statement over the next few weeks for small unfamiliar charges. If you get an email or text claiming to be from the chain and asking you to log in via a link, treat it with suspicion: breached customer lists are exactly what phishing crews go shopping for next.