TechRadar 1h ago

Chick-fil-A reveals data breach - customers warned hackers may have accessed their account info

Breach Details

Thousands of users in Texas alone had their data compromised and the company is now sending out notifications. Chick‑fil‑A confirmed a credential stuffing attack between June 17-19, breaching thousands of accounts.

Exposed data includes names, emails, membership numbers, payment details, birthdays, and addresses
Company logged out users, removed payment methods, restored balances, and notified multiple US states

Chick-fil-A is notifying its customers of a worrying cyber incident involving their sensitive information being leaked. In a data breach notification letter being sent to affected customers, the fast food giant said it recently identified “suspicious login activity”, which prompted it to investigate further. That investigation determined that unidentified threat actors ran a credential stuffing attack between June 17 and June 19, 2026, successfully breaching an unknown number of accounts.

What Is Credential Stuffing?

A credential stuffing attack is when threat actors use automated systems to try thousands of username/password combinations against a service to see which ones work. The login credentials are usually obtained on the black market, in advance.

Data Exposed

Since the attackers broke into people’s accounts, the data found inside was exposed. According to the notification letter, that data includes names, email addresses, Chick-fil-A One membership numbers, mobile pay numbers, QR codes, last four digits of payment cards, and the amount of Chick-fil-A credit. “The information may have included the month and day of your birthday, phone number, and address,” the company added.

Company Response

After it discovered the intrusion, Chick-fil-A logged everyone out of their accounts and removed any stored payment methods. It also restored impacted customers’ account balances and, in some cases, added rewards to victim accounts, too.

Affected Users

We don’t know exactly how many people are affected by the breach, but it is definitely in the thousands. BleepingComputer found that the company notified the Texas Attorney General that the breach impacted 2,182 of its citizens. Similar notifications went out to Iowa, the District of Columbia, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Vermont, and Rhode Island.

About Chick-fil-A

Chick-fil-A is one of the largest fast-food restaurant chains in the US, operating more than 3,000 restaurants across the United States, Canada and Puerto Rico. It employs over 200,000 people and generated about $10.3 billion in annual revenue in 2025.