Chick-fil-A is notifying customers about a data breach following an automated credential stuffing attack that targeted the fast-food chain’s mobile app and website in June 2026. This recent wave of corporate account takeovers is heavily driven by an influx of stolen data on the dark web, specifically following a massive mid-2025 leak of 16 billion credentials discovered across exposed databases.
What We Know
- The automated attacks hit the company’s systems between June 17 and June 19, 2026.
- An internal investigation confirmed the unauthorized access on July 13, 2026.
- A filing with the Texas Attorney General indicates at least 2,182 residents were affected in that state.
Attackers executed the breach by using login pairs acquired from a third-party source to bypass basic authentication limits. Following the July 13 discovery, the company determined that unauthorized parties successfully accessed information within certain Chick-fil-A One accounts, according to a detailed security report outlining the timeline.
The compromised information includes customer names, email addresses, Chick-fil-A One membership numbers, and mobile pay numbers. The attackers also gained access to account credit balances, QR codes, and the last four digits of stored credit or debit cards. If customers stored additional personal details in their accounts, saved phone numbers, physical addresses, and birth dates may have also been exposed.
While the fast-food chain has not publicly disclosed the total number of impacted users nationwide, the company confirmed that notifications were sent to residents in Iowa and other states alongside the Texas filing.
A Repeat Offense Exposes Systemic Authentication Vulnerabilities
This is not the first time the fast-food giant has fallen victim to this exact attack vector. Chick-fil-A previously suffered a widespread credential stuffing attack between December 2022 and February 2023. That incident compromised the personal data of over 71,000 customers and resulted in federal class-action litigation, a prior 2023 breach that highlights ongoing struggles with app security. The repeat nature of this breach indicates that cybercriminals are continuing to weaponize large credential dumps alongside open-source automation tools to target the retail and fast-food sectors with high success rates.