Cybercrime

Chick-fil-A Discloses Mobile App, Website Data Breach in 10 States

Is Chick-fil-A's cyberattack response a helpful guide or proof that corporations keep failing consumers?

Published JUL 22

Chick-fil-A Discloses Mobile App, Website Data Breach in 10 States

Story

Above: The Chick-fil-A logo displayed on a mobile phone. Image credit: Timon Schneider/SOPA Images/Getty Images

The Facts

Chick-fil-A notified customers in 10 states and Washington, D.C., on Monday that a credential stuffing attack targeted its website and mobile app between Friday and Sunday, with the company determining on July 13 that account data may have been compromised.
qz.com
ABC 10 Northern California
The breach exposed customers' names, email addresses, membership numbers, QR codes, stored credit balances and the last four digits of linked payment cards. Birthdays, phone numbers and addresses were also potentially accessed if stored in affected accounts.
Azfamily
Bleeping Computer
Chick-fil-A told the Texas Attorney General that 2,182 state residents were affected and informed Massachusetts that 39 of its residents were impacted. The company has not disclosed the total number of affected customers nationwide.
qz.com
ABC 10 Northern California
In response to the breach, Chick-fil-A logged out all compromised accounts, removed saved payment methods, restored affected account balances and reset passwords. The company also added rewards to impacted accounts and urged customers to set new, unique passwords.
AJC
Bleeping Computer
Credential stuffing attacks use automated tools to test stolen username and password combinations against online accounts, with login credentials typically sourced from prior data breaches and sold on dark web markets.
qz.com
Dark Reading
Chick-fil-A previously disclosed a similar credential stuffing attack in 2023, in which unauthorized parties accessed more than 71,000 customer accounts between December 2022 and February 2023, exposing comparable categories of personal information.
Bleeping Computer
Dark Reading

Sources Split

LEFT

CENTER

RIGHT

ESTAB
CRIT

CENTER

PRO
ESTAB

The Spin

Narrative A

Chick-fil-A has now suffered multiple breaches, and the pattern reflects a broader corporate failure to adopt basic safeguards like multi-factor authentication. Data breaches jumped 70% between 2021 and 2024, yet most companies face no real legal consequences, leaving customers to spend countless hours cleaning up the mess on their own. Without a national minimum standard, corporations will keep cutting corners while ordinary people pay the price.

Time

Dark Reading

Narrative B

Data breaches are always unfortunate, but Chick-fil-A acted fast by resetting passwords, removing stored payment methods and restoring account balances for affected customers. The chain also added loyalty rewards as a goodwill gesture and urged customers to set strong, unique passwords right away. Anyone affected should scan financial accounts for unauthorized charges and report anything suspicious to their bank or the FTC.