# Chick-fil-A Confirms Data Breach After Credential Stuffing Attack Exposes Customer Personal and Payment Data

> Chick-fil-A confirmed a credential-stuffing account-takeover campaign against its Chick-fil-A One loyalty platform (web and mobile app) between June 17-19, 2026, discovered July 13, 2026. Attackers used username/password pairs sourced from unrelated third-party breaches to log into customer accounts, exposing names, emails, membership numbers, Mobile Pay numbers/QR codes, loyalty balances, partial payment-card numbers, and in some cases dates of birth, phone numbers, and addresses.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1654
- **ID:** TL-2026-1654
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 22-23, 2026, Chick-fil-A, Inc. began notifying customers and multiple U.S. state attorneys general of a data breach affecting Chick-fil-A One, the company's loyalty and mobile-ordering platform. According to the notifications, unauthorized parties conducted an automated credential-stuffing campaign between June 17 and June 19, 2026, using username/password combinations harvested from prior, unrelated third-party data breaches to attempt logins against Chick-fil-A's website and mobile application. Because the credentials were valid due to password reuse rather than any direct compromise of Chick-fil-A's own systems, a subset of login attempts succeeded, granting attackers access to legitimate customer accounts.

Chick-fil-A determined on July 13, 2026 that customer account information may have been viewed or acquired during the unauthorized access window. Exposed data varies by account and may include the customer's name, email address, Chick-fil-A One membership number, Mobile Pay number and account QR code, remaining loyalty/gift balance, and the last four digits of any payment card stored on the account. For accounts where the customer had voluntarily supplied additional profile data, date of birth, phone number, and residential address may also have been exposed. Chick-fil-A states it does not store full payment-card numbers, CVVs, or bank account credentials, limiting the direct financial-fraud exposure to card-present/card-not-present fraud using the exposed last-four digits in combination with other identity data (i.e., social-engineering/identity-verification bypass rather than direct card cloning).

Remediation actions taken by Chick-fil-A include forcibly logging out all impacted accounts, requiring password resets, removing stored payment methods from affected accounts, restoring any drained loyalty/gift balances, and issuing rewards credits to affected customers. The company has recommended customers set a new, unique password not reused elsewhere and enable multi-factor authentication via a verified mobile number.

Regulatory breach notifications filed to date confirm at least 2,182 Texas residents and 39 Massachusetts residents affected, with additional notifications sent to the District of Columbia, Iowa, Maryland, New Mexico, New York, North Carolina, Oregon, Rhode Island, and Vermont. Chick-fil-A has not disclosed a nationwide total. No CVE, exploited software vulnerability, or named threat actor/malware family has been identified — this is a pure credential-stuffing/account-takeover (ATO) campaign exploiting password reuse, not an exploit of a Chick-fil-A application flaw.

This is the second publicly disclosed credential-stuffing incident against Chick-fil-A One: in March 2023, the company confirmed a similar campaign that compromised more than 71,000 customer accounts between December 2022 and February 2023, indicating the loyalty platform remains a recurring target for ATO actors monetizing stolen-credential lists against high-value consumer loyalty/payment ecosystems.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1589.001 Credentials
- T1588.005 Exploits
- T1650 Acquire Access
- T1078 Valid Accounts
- T1110 Brute Force
- T1110.004 Credential Stuffing
- T1087 Account Discovery
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1074 Data Staged
- T1592 Gather Victim Host Information
- T1595.002 Vulnerability Scanning
- T1586 Compromise Accounts
- T1090 Proxy
- T1071.001 Web Protocols
- T1078 Valid Accounts
- T1657 Financial Theft
- T1531 Account Access Removal

## Sources

- [Chick-fil-A Confirms Data Breach After Credential Stuffing Attack Exposes Customer Personal and Payment Data](https://gbhackers.com/chick-fil-a-confirms-data-breach-after-credential-stuffing-attack-exposes-customer-personal-and-payment-data/)
- [Chick-fil-A discloses data breach after credential stuffing attacks](https://www.bleepingcomputer.com/news/security/chick-fil-a-discloses-data-breach-after-credential-stuffing-attacks/)
- [Chick-fil-A loyalty accounts hijacked using stolen passwords](https://www.malwarebytes.com/blog/data-breaches/2026/07/chick-fil-a-loyalty-accounts-hijacked-using-stolen-passwords)
- [Chick-fil-A Sends Data Breach Notifications After Password Attacks](https://www.forbes.com/sites/daveywinder/2026/07/22/chick-fil-a-says-some-customer-accounts-breached-by-stuffing-attacks/)
- [Chick-fil-A hit by credential stuffing attack exposing customer data](https://cyberinsider.com/chick-fil-a-hit-by-credential-stuffing-attack-exposing-customer-data/)
- [Chick-fil-A One Data Breach: Credential Stuffing Hits Loyalty App a Second Time](https://www.techtimes.com/articles/321315/20260722/chick-fil-one-data-breach-credential-stuffing-hits-loyalty-app-second-time.htm)
- [Chick-fil-A data breach hits loyalty app accounts in June attack](https://www.yahoo.com/news/us/articles/chick-fil-data-breach-hits-173758677.html)
- [Chick-fil-A reveals data breach in rewards program](https://www.wsbtv.com/news/trending/chick-fil-a-reveals-data-breach-rewards-program/E4MQQ5SOMBH6PL2D6NTU33O6PE/)
- [Chick-fil-A Data Breach Hits Customers After Credential Stuffing](https://www.safestate.com/post/chick-fil-a-data-breach-hits-customers-after-credential-stuffing)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1654