Chick-Fil-A Data Breach Exposed Loyalty Account Info After A June Cyberattack Using Stolen Credentials

Chick-fil-A confirmed Wednesday that a security incident may have exposed personal information tied to a limited number of Chick-fil-A One loyalty accounts.

Unauthorized parties targeted the company's website and mobile app between June 17 and June 19 using account credentials obtained from a third-party source, a method known as credential stuffing, where attackers use username and password combinations stolen from other data breaches to try logging into unrelated accounts.

The data potentially exposed includes customer names, email addresses, Chick-fil-A One membership numbers, mobile payment numbers, the last four digits of payment cards and the amount of Chick-fil-A credit stored in the account.

The breach affected customers in Iowa, Maryland, Massachusetts, New Mexico, New York, North Carolina, Oregon, Rhode Island, Vermont and Washington D.C.

Chick-fil-A discovered suspicious login activity and notified affected customers Monday. The company reset passwords for impacted accounts, restored any loyalty balances that were affected and added reward credits to affected accounts as an apology.

"We sincerely apologize for any inconvenience or concern," the company said in a statement.

If you have a Chick-fil-A One account, check your email for a notification from the company. Even if you didn't receive one, consider changing your password, especially if you reuse passwords across multiple services.