Chick-fil-A confirms credential stuffing attack exposed customer account data

Full text

Chick‑fil‑A confirmed a credential stuffing attack between June 17–19, breaching thousands of accounts

Exposed data includes names, emails, membership numbers, payment details, birthdays, and addresses

Company logged out users, removed payment methods, restored balances, and notified multiple US states

Chick-fil-A is notifying its customers of a worrying cyber incident involving their sensitive information being leaked.

In a data breach notification letter being sent to affected customers, the fast food giant said it recently identified “suspicious login activity”, which prompted it to investigate further.

That investigation determined that unidentified threat actors ran a credential stuffing attack between June 17 and June 19 2026, successfully breaching an unknown number of accounts.

Logging everyone out

A credential stuffing attack is when threat actors use automated systems to try thousands of username/password combinations against a service to see which ones work. The login credentials are usually obtained on the black market, in advance.

Since the attackers broke into people’s accounts, the data found inside was exposed. According to the notification letter, that data includes names, email addresses , Chick-fil-A One membership numbers, mobile pay numbers, QR codes, last four digits of payment cards, and the amount of Chick-fil-A credit.

“The information may have included the month and day of your birthday, phone number, and address,” the company added.

After it discovered the intrusion, Chick-fil-A logged everyone out of their accounts and removed any stored payment methods. It also restored impacted customers’ account balances and, in some cases, added rewards to victim accounts, too.

We don’t know exactly how many people are affected by the breach, but it is definitely in the thousands.

BleepingComputer found that the company notified the Texas Attorney General that the breach impacted 2182 of its citizens. Similar notifications went out to Iowa, the District of Columbia, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Vermont, and Rhode Island.

Chick-fil-A is one of the largest fast-food restaurant chains in the US, operating more than 3,000 restaurants across the United States, Canada and Puerto Rico. It employs over 200,000 people and generated about $10.3 billion in annual revenue in 2025.