Chick-fil-A Cyberattack Exposes Customer Data in 10 States Across the US

Updated on: July 22, 2026 / 11:25 AM EDT / CBS Atlanta

Chick-fil-A, the popular American fast-food chain, has recently alerted its customers in 10 states after a cyberattack potentially exposed their personal information stored in some Chick-fil-A One loyalty accounts. This security incident has sparked concerns among customers and raised questions about the company's data security measures. The company has acknowledged the breach, stating that it occurred due to an automated 'credential-stuffing' attack targeting its website and mobile app.

The attack, which happened between June 17 and June 19, involved unauthorized parties using usernames and passwords obtained from a third-party source. On July 13, the company concluded that the attackers may have accessed information in affected accounts. This information includes customers' names, email addresses, Chick-fil-A One membership numbers, Mobile Pay numbers and QR codes, the last four digits of payment card numbers, and Chick-fil-A gift card balances. In a statement, Chick-fil-A emphasized that it is taking steps to enhance its security measures to prevent similar incidents in the future.

Customers in the District of Columbia, Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, and Vermont are affected by the data breach. The company has sent data breach notification letters to these customers, informing them of the potential exposure of their personal information. Chick-fil-A has also taken steps to restore impacted Chick-fil-A One balances and added rewards to affected accounts for the inconvenience caused.

Chick-fil-A's Chief Information Security Officer (CISO) emphasized in a statement that the company takes the security of its customers' information seriously and is committed to maintaining their trust. The company has assured customers that it is taking all necessary steps to prevent similar incidents in the future. However, experts have raised concerns about the effectiveness of Chick-fil-A's current security measures, citing the lack of robust verification processes and inadequate encryption methods.

Experts argue that companies like Chick-fil-A need to adopt more robust security measures to protect their customers' sensitive information. This includes the implementation of multi-factor authentication, regular security audits, and penetration testing to identify vulnerabilities. Additionally, companies must ensure that their employees are trained to identify and respond to potential security threats.

Consumers can play a crucial role in protecting themselves from data breaches by using strong, unique passwords, regularly reviewing their account activity, and monitoring their bank and credit card statements for any suspicious activity. Chick-fil-A has also recommended that customers reset their passwords immediately and use strong, unique passwords that are not used on other websites. By taking these precautions, customers can minimize the risk of their personal information being compromised in a data breach.

In conclusion, the Chick-fil-A cyberattack highlights the importance of robust security measures in protecting customers' sensitive information. Companies must prioritize the security of their customers' data and adopt more effective measures to prevent and respond to potential security threats. By doing so, they can maintain the trust of their customers and prevent the devastating consequences of a data breach.

In an effort to address the issue, Chick-fil-A will enhance its security, monitoring, and fraud controls. The company has also notified the relevant authorities and is cooperating with any ongoing investigations. As the situation continues to unfold, it is essential to stay informed and take necessary precautions to protect our personal information.