Chick-fil-A has notified customers across more than a dozen U.S. states that attackers accessed Chick-fil-A One loyalty accounts in a credential stuffing attack, the fast-food chain’s second such breach in three years.
The attack broke into Chick-fil-A One loyalty accounts between June 17 and 19, 2026, exposing names, QR codes, stored balances, and partial card numbers.
How the attack unfolded
Chick-fil-A says it detected suspicious login activity against some Chick-fil-A One accounts in June and launched an investigation.
It later concluded that unauthorized parties ran an automated credential stuffing attack against its website and mobile app between June 17 and June 19, 2026, using usernames and passwords obtained from previous data breaches or other third-party sources, according to data breach notification letters filed with multiple state Attorney General offices.
Credential stuffing is an attack where criminals take username-password pairs stolen from one service and automatically try them on many other websites and apps to see where they still work.
The breach stemmed from reused credentials rather than a flaw in Chick-fil-A’s own systems. Chick-fil-A determined on July 13, 2026, that the unauthorized parties may have accessed information in affected accounts.
The information exposed includes customers’ names, email addresses, Chick-fil-A One membership numbers and mobile pay numbers, QR codes, the amount of Chick-fil-A credit, and the last four digits of credit or debit card numbers.
Attackers may have also gained access to birth dates, phone numbers, and addresses if those details were stored in the compromised accounts.
Scope and state notifications
According to the Commonwealth of Massachusetts 2026 Data Breach Notification Report, Chick-fil-A reported the breach on July 20.
Data breach notifications filed in Texas and Massachusetts show that 2,182 Texans and 39 Massachusetts residents were affected. Similar notifications were filed in the District of Columbia, Iowa, Maryland, New Mexico, New York, North Carolina, Oregon, Rhode Island, and Vermont, suggesting the leak affected at least several thousand individuals.
Chick-fil-A has not publicly disclosed a total number of affected customers across the U.S. The multi-state notification pattern suggests the true number of affected customers runs well into the tens of thousands nationally.
Company response
In response, Chick-fil-A immediately secured accounts by forcing log-outs, removing stored payment methods, and resetting passwords. It added extra rewards to affected accounts as a gesture of goodwill.
The company offers multi-factor authentication but does not require it, the same gap that allowed attackers to succeed in both the 2023 and 2026 incidents. Security researchers note that mandatory MFA on loyalty apps with stored payment data would block this entire class of attack.
The incident is part of a broader wave of attacks in 2026. July’s breaches came from every direction, including an insurance company confirming the year’s biggest driver’s license spill, a Big Four accounting firm facing an extortion deadline, and a healthcare giant learning that a company it acquired came with compromised systems included.
The Chick-fil-A incident also illustrates the compounding exposure created by stored loyalty balances and partial payment data, information that sits dormant in apps millions of consumers rarely revisit. Security professionals warn that automated credential attacks are growing faster than app operators are updating their authentication requirements.
What affected users should do
If you used the same password on any other service such as email, banking, streaming, or other food or retail apps, change it on those accounts as well. Attackers routinely run the same stolen credentials across dozens of platforms simultaneously.
The Chick-fil-A One app supports MFA via a verified mobile phone number, and enabling it will block the specific attack type used in both the 2023 and 2026 breaches.
The company has not disclosed the total number of accounts compromised nationwide, so not receiving a notification letter does not guarantee your account was untouched.
The recurrence underscores a structural vulnerability across the loyalty-app sector. As the enterprise software market accelerates adoption of cloud-based authentication and identity tools, consumer-facing apps that store payment data without mandating MFA remain an easy mark for automated attacks using credentials harvested from entirely unrelated breaches. Chick-fil-A has not commented on whether it plans to make multi-factor authentication mandatory going forward.
