Breaches and incidentsBriefReported by a reputable outlet, citing the company
Chick-fil-A: credential stuffing against the app and website
Chick-fil-A said attackers ran an automated attack 17 to 19 Jun 2026 “using account credentials ... obtained from a third-party source”, accessing...
- Disclosed
What happened
- Chick-fil-A said attackers ran an automated attack 17 to 19 Jun 2026 “using account credentials ... obtained from a third-party source”, accessing Chick-fil-A One accounts: names, emails, membership and mobile pay numbers, QR codes, credit balances and last four card digits. State filings (Texas 2,182, Massachusetts 39); later reports put the total above 13,000.
- Root cause: credential stuffing with reused passwords; second such incident after a 2022 to 2023 campaign affecting 71,000+.
- No attacker named.
- Accounts logged out, payment methods removed, balances restored.
Sources
- https://www.bleepingcomputer.com/news/security/chick-fil-a-discloses-data-breach-after-credential-stuffing-attacks/
- https://www.bleepingcomputer.com/news/security/chick-fil-a-data-breach-affects-more-than-13-000-customers/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.