Attackers used credentials obtained elsewhere to access a limited number of Chick-fil-A One loyalty accounts, the company said.
ATLANTA — Chick-fil-A is notifying customers whose loyalty accounts may have been accessed during an automated attack that exposed names, contact information and limited payment-card details, according to breach notices filed with state authorities.
The Atlanta-based restaurant company said unauthorized parties targeted its website and mobile application from June 17 through June 19 using email addresses and passwords obtained from a third-party source. Chick-fil-A said it determined July 13 that the attackers may have accessed information stored in some Chick-fil-A One accounts.
The incident is an example of credential stuffing, in which attackers test stolen username-and-password combinations on other websites. The method can succeed when customers reuse the same login details across several services. Chick-fil-A described the number of affected accounts as limited but did not release a nationwide total.
Information that may have been accessed included customers’ names, email addresses, Chick-fil-A One membership numbers, mobile payment numbers, account QR codes, available Chick-fil-A credit and the last four digits of stored credit or debit cards. Birth dates, phone numbers and mailing addresses also may have been exposed when customers had saved those details in their accounts.
The company’s notice did not say that full payment-card numbers, card security codes or Social Security numbers were accessed. Chick-fil-A also did not disclose evidence that its internal systems had been penetrated to obtain the login credentials. The company said the credentials used in the attack came from a source outside Chick-fil-A.
After detecting suspicious activity, Chick-fil-A forced affected customers out of their accounts and removed saved payment methods. The company said it reset passwords, restored account balances and added a reward to the affected accounts. Customers receiving notices were told to create a new password that had not been used for another account.
A Chick-fil-A spokesperson said the company took immediate steps to secure and restore the accounts and was contacting customers who may have been affected. The company apologized for the concern caused by the incident and said it remained committed to protecting customers’ trust.
State filings provide only a partial view of the breach’s size. Chick-fil-A reported that 2,182 Texas residents and 39 Massachusetts residents were affected. Notifications also included information for residents of several other states and the District of Columbia, but the company had not published a complete state-by-state count as of Wednesday.
The restaurant chain reported a similar security incident in 2023, when attackers used credentials acquired from another source to access more than 71,000 customer accounts. In that case, unauthorized users accessed personal information and used rewards balances from some Chick-fil-A One accounts.
Chick-fil-A advised affected customers to watch account and financial statements for unfamiliar activity. The company had not announced evidence Wednesday that all Chick-fil-A One members were affected, and notifications were being sent directly to customers whose accounts may have been accessed.
Author note: Last updated July 22, 2026.