Chick-fil-A Confirms Hackers Used Stolen Passwords to Break Into Loyalty Accounts

What happened

Chick-fil-A confirmed this week that a security incident hit an unspecified number of Chick-fil-A One loyalty accounts. The company said it moved to lock down affected accounts once it found the problem, according to a statement given to FOX Business.

According to a notice reported by USA Today, unauthorized parties targeted Chick-fil-A's website and mobile app between June 17 and June 19. Customers were notified this past Monday after the company discovered suspicious login activity involving certain Chick-fil-A One accounts.

How they got in

This wasn't a breach of Chick-fil-A's own systems. The attackers used login credentials pulled from a third-party source, USA Today reported. These were stolen usernames and passwords from other, unrelated data breaches. That's a classic credential-stuffing attack: hackers take username-password combos leaked elsewhere and run them against a different company's login page, betting that customers reused the same password.

It works because people reuse passwords across sites. Chick-fil-A didn't leak the credentials. Someone else's breach, somewhere else, handed attackers the keys.

What was exposed

The compromised data included customers' names, email addresses, Chick-fil-A One membership and mobile payment numbers, the last four digits of payment cards, and the amount of Chick-fil-A credit stored in accounts, according to the NY Post's reporting on the company's disclosure. Full card numbers do not appear to have been exposed based on what's been disclosed.

Customers in ten states and Washington, D.C. were affected: Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, Vermont and the District of Columbia, per USA Today's reporting. That list likely reflects state-specific breach notification laws requiring disclosure to residents of those jurisdictions, not necessarily the full scope of who was impacted.

The company's response

A Chick-fil-A spokesperson told FOX Business the company "took steps to immediately address, secure and restore accounts" once the suspicious activity was identified, and is "communicating directly with all customers who may have been impacted." The spokesperson added the company "sincerely apologize[s] for any inconvenience or concern" and remains "committed to maintaining customers' trust."

No dollar figure, no number of affected accounts, and no detail on what remediation steps, like forced password resets, are being offered to customers has been disclosed publicly in the reporting available. Chick-fil-A has not said whether it's offering credit monitoring or other protections.

The exact date Chick-fil-A discovered the suspicious activity hasn't been disclosed, so it's unclear precisely how much time passed between discovery and the Monday notification to customers. State breach notification laws generally require disclosure "without unreasonable delay," and companies often take time to confirm scope, contain an incident, and prepare notices before going public. No regulator has announced an investigation into the timeline, and no source here alleges Chick-fil-A violated any specific disclosure deadline.

This is not a hack of Chick-fil-A's servers or a failure of the company's internal security architecture in the way a SQL injection or ransomware attack would be. Credential stuffing exploits customer password reuse, a problem that exists across nearly every online service with a login. Companies can and do mitigate it with multi-factor authentication, rate-limiting login attempts, and monitoring for suspicious login patterns, which appears to be how Chick-fil-A caught this one in the first place.

That doesn't mean Chick-fil-A bears zero responsibility. Companies that store payment data and loyalty balances are expected to have systems that flag and block credential-stuffing attempts before attackers succeed at scale. Whether Chick-fil-A had those defenses in place, and whether they worked as intended, hasn't been detailed publicly.

Chick-fil-A customers in the affected states should watch for a direct notice from the company and consider changing their Chick-fil-A One password, particularly if it's reused anywhere else. No class-action lawsuit or state attorney general action has been reported as of this writing. Given the scale of loyalty program breaches at other retailers in recent years, whether this incident stays limited to the states already named, or expands as Chick-fil-A's investigation continues, remains an open question the company hasn't yet answered.