Chick-fil-A data breach exposes customer accounts

Your Chick-fil-A One account makes it easy to order food, collect points and keep payment information ready for your next visit. That convenience can also make the account valuable to criminals.

Chick-fil-A is now warning customers after attackers gained access to certain loyalty accounts. The incident exposed personal information and account details, while also raising new concerns about password reuse.

Even if Chick-fil-A never contacted you, this breach gives you a good reason to review your password, stored payment methods and recent rewards activity.

AMAZON RECALL TEXT SCAM COMES WITH RED FLAGS

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class, "Sick of Spam?," has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

COULD THE 7-ELEVEN BREACH AFFECT YOU?

Chick-fil-A says it first spotted suspicious login activity involving certain Chick-fil-A One accounts. The company then investigated and found an automated attack against its website and mobile app. The attack ran from June 17 through June 19, 2026. Chick-fil-A determined on July 13 that unauthorized parties may have accessed information stored inside affected accounts.

The attackers used email addresses and passwords obtained from a third-party source. They then tested those login combinations against Chick-fil-A One accounts. When a customer had reused the same password, the attackers had a chance of getting inside.

Chick-fil-A has not disclosed the total number of affected customers. However, public filings show that the breach affected 2,182 Texas residents and 39 Massachusetts residents. The company also submitted notices involving residents of Iowa, the District of Columbia, Maryland, New Mexico, New York, North Carolina, Oregon, Vermont and Rhode Island.

WHAT A SCAMMER SEES THE MOMENT THEY GOOGLE YOUR NAME

The information available to the attackers varied by account. According to Chick-fil-A's notification, the exposed data may have included:

The notification lists only the last four digits of payment cards. It does not list full card numbers, Social Security numbers or bank account details among the exposed information. Still, the other details could help criminals create convincing scams. A message that includes your name, loyalty membership information or partial card digits may feel legitimate. The QR code exposure also raises questions because customers use account QR codes to earn points and access rewards. Chick-fil-A has not publicly explained whether attackers used any exposed QR codes. We reached out to Chick-fil-A for comment, but did not hear back by our deadline.

Credential stuffing sounds technical, but the attack follows a simple pattern. Criminals collect email addresses and passwords from older data leaks. Then automated tools try those combinations across other websites and apps.

The attack works because many people reuse passwords. One old password breach can therefore lead to account takeovers at companies that had no connection to the original leak. Chick-fil-A says the login details used in this attack came from a third-party source. The company's notification describes attackers arriving with stolen credentials and testing them against its services.

That distinction may explain how the attack started. However, it offers little comfort when someone gains access to your rewards, contact details and stored payment information. Relying on a username and password alone creates more opportunities for account takeovers. Multifactor authentication can provide another barrier when a password has already been stolen.

A Chick-fil-A, Inc. spokesperson provided CyberGuy with the following statement:

"We recently identified a security incident that may have affected a limited number of Chick-fil-A One Loyalty accounts. Upon discovering the issue, we took steps to immediately address, secure and restore accounts, and we are communicating directly with all customers who may have been impacted. We sincerely apologize for any inconvenience or concern this situation may have caused and remain committed to maintaining the trust our guests place in us every day."

The company's customer notice provides several additional details. Chick-fil-A logged affected customers out, removed saved payment methods and added rewards to their accounts.

This isn’t Chick-fil-A's first major credential stuffing incident. In March 2023, the company confirmed that attackers had accessed more than 71,000 customer accounts. That earlier campaign ran from December 2022 through February 2023.

The attackers accessed personal information and used stored rewards balances in some accounts. The repeat attack shows how long stolen login information can remain useful to criminals. They can keep old credential lists, combine them with newer leaks and test them across popular services.

A restaurant loyalty account may seem less important than your bank or email. Yet it can still contain personal information, stored funds and payment details. It can also give an intruder clues about other accounts you use, especially when your email address and password appear together in several places.

You can take these steps even if Chick-fil-A never contacted you about the breach.

Open the official Chick-fil-A app or type the company's website into your browser. Then create a new password that you have never used on another account. Avoid changing one character in an older password. Criminals often test common variations after a stolen password stops working. Chick-fil-A recommends using a unique password that has no connection to your other online accounts.

Changing only your Chick-fil-A password leaves other accounts exposed. Update the password on every account where you used the same login combination. Give priority to your email because an attacker can use it to request password resets elsewhere. Then review accounts that store payment methods or sensitive personal information. A password manager can help you find reused passwords and replace them with unique ones. It also removes the need to remember every login yourself.

Open the Chick-fil-A app and look for orders or balance changes you do not recognize. In the app, tap For You , then open Account > Transactions > Transaction History . Chick-fil-A says customers can review up to one year of account activity. Check your rewards activity separately. Someone may have redeemed or gifted rewards without placing an obvious food order. Also review your phone number and saved addresses. Correct any account details that someone changed.

Chick-fil-A says it removed saved payment methods from affected accounts. However, you should confirm that your cards no longer appear if you received a breach notice. To check, open the app and tap For You . Then go to Account > Payments > Manage payment methods . Chick-fil-A advises customers to resolve unauthorized activity and change their passwords before adding a payment method again. Leaving a card out of a restaurant app may create an extra step at checkout. It also gives an account thief one less thing to misuse.

The notification lists the last four digits of payment cards among the information attackers may have accessed. Those digits alone usually cannot authorize a purchase. However, criminals could combine them with other personal details during a phishing attempt. Review recent charges and turn on transaction alerts through your bank or card issuer. Contact the financial institution immediately if you find anything unfamiliar.

A breach can lead to a second round of trouble when criminals send fake security alerts. Be cautious with emails or texts claiming your Chick-fil-A account requires immediate action. The message may offer a refund, replacement rewards or help restoring your balance. Avoid clicking the link. Open the official Chick-fil-A app yourself or type the company's website address into your browser. Also check the sender's full email address. A familiar logo and a polished message provide no guarantee that Chick-fil-A sent it.

Credential stuffing does not require malware on your phone or computer. However, criminals may follow a breach with fake security alerts designed to steal more information. Strong antivirus software can help warn you about malicious links, fake websites and suspicious downloads. Keep the protection active on every device you use to check email or access your Chick-fil-A account. The best way to protect yourself from malicious links that install malware is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, helping protect your personal information and digital assets. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

The Chick-fil-A breach may have exposed names, phone numbers and saved addresses for some customers. Criminals can combine those details with information found on data broker and people-search sites to create more believable scams. A data removal service can send removal requests to these companies and continue checking whether your information returns. However, it cannot remove data already taken from your Chick-fil-A account or guarantee that every public record disappears. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Chick-fil-A does not currently advertise a customer-facing multifactor authentication option for Chick-fil-A One accounts. However, you should enable it on your email account, financial services and any account that stores sensitive information. Use an authenticator app or passkey when available. These options provide stronger protection than text message codes in many situations. Multifactor authentication can block an intruder who has already obtained your password.

Credential stuffing does not require malware on your phone or computer. However, follow-up phishing messages may try to install harmful software. Keep your phone, computer and browser updated. Use strong antivirus protection that can warn you about malicious links and downloads. Never install an app through a link in an unexpected breach notification. Use the Apple App Store or Google Play Store to find the official version.

The Chick-fil-A data breach shows how a password stolen from one company can create problems somewhere else. Attackers reportedly used credentials obtained from a third party. They then tried those logins against Chick-fil-A's website and mobile app. Chick-fil-A secured the affected accounts, removed stored payment methods and restored balances. However, the total number of affected customers remains undisclosed. The most important move now involves changing any reused password. Your Chick-fil-A login should have a password that appears nowhere else. You should also review your rewards activity, account information and financial statements. Be ready for convincing phishing messages that use details taken from the breach.

Have you ever had a loyalty account hacked, lost rewards or spotted account changes you never made? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com. All rights reserved.